feat(deviceplugin): accept the product resource naming strategy

[karlkfi]

Depends on ROCm/k8s-device-plugin#246. Draft until that merges and a plugin image carrying the strategy ships.

Follow-up to #663, which was the other half: that one makes the driver-upgrade eviction predicate recognise the new resource names, this one makes the operator accept the flag that produces them. #663 stands alone and is correct against the plugin as shipped today — it also fixes nps2/nps8, which miss right now — so it is not blocked on anything.

Problem

The operator keeps its own copy of the accepted resource_naming_strategy values. A DeviceConfig setting product fails ValidateDevicePluginSpec before any pod ever advertises the new name, so the strategy is unreachable through DeviceConfig no matter what the device plugin supports.

Changes

• internal/utils.go — ProductStrategy constant, alongside SingleStrategy and MixedStrategy.
• internal/validator/specValidators.go:160 — added to the allow-list.
• api/v1alpha1/deviceconfig_types.go:477 — the doc comment that kubectl explain and the OLM bundle report.
• Four generated artifacts carrying that comment: config/crd/bases/, config/manifests/bases/, both bundle/manifests/, and helm-charts-k8s/crds/.
• Two hand-maintained values.yaml comments that enumerate the same values: hack/k8s-patch/metadata-patch/ (source) and helm-charts-k8s/ (its copy).
• internal/plugin/plugin.go:112-119 — the PF/VF passthrough force-default used bare "resource_naming_strategy" and "mixed" literals rather than the utils constants, so a grep-driven update of those constants missed it. No behaviour change; it still defaults to mixed.

On regenerating

The CRD artifacts were regenerated with controller-gen crd directly rather than make manifests. That target also runs update-registry and update-version, which sed image tags and project versions across the tree — unrelated churn that would bury a one-line doc change. The remaining artifacts were edited to match; each is a single line.

Testing

go build ./..., go vet ./internal/... and go test ./internal/... pass.

internal/validator/ had no test file. Added specValidators_test.go covering the three strategies and two negatives. Reverting the allow-list entry fails it on exactly the product case and nothing else:

ValidateDevicePluginSpec accepts every naming strategy the device plugin implements [It] product
  [FAILED] Expected success, but got an error:
      Invalid flag value: resource_naming_strategy=product. Supported values: [single mixed]

Not exercised against a live cluster or an OLM install.

Sequencing

Merging this before a plugin image carrying product is published would let a DeviceConfig request a value the plugin exits at startup on. The operator's default is the floating rocm/k8s-device-plugin:latest (internal/plugin/plugin.go:55), so users on the default pick the support up with the image; users pinning an older tag would get a crash-looping device plugin container until they move. That is the reason this is split out of #663 rather than folded into it.