Add repo-watcher-controller for polling remote Git refs

Introduces a fourth controller that watches GitRepository resources and
polls their remotes via git ls-remote on a configurable per-repo interval
(spec.pollInterval, defaulting to 30s). It auto-creates, updates, and
deletes GitBranch CRDs to reflect the actual state of the remote,
enabling fast detection of external pushes to trigger downstream sync.

Key changes:
- Add PollInterval field to GitRepositorySpec
- New pkg/reconciler/repowatcher with controller and reconciler
- New cmd/repo-watcher-controller binary
- CRD manifest updated for pollInterval
- Deployment manifest for the new controller
- Unit tests for ref filtering, naming, and poll interval logic
- CLAUDE.md updated with new controller docs and Go module workaround

https://claude.ai/code/session_01P7xfBqARU5DFS8QJ4uDPVj

config/deployments/repo-watcher-controller.yaml

@@ -0,0 +1,51 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: repo-watcher-controller
+  namespace: git-system
+  labels:
+    app.kubernetes.io/name: git-k8s
+    app.kubernetes.io/component: repo-watcher-controller
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/component: repo-watcher-controller
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: git-k8s
+        app.kubernetes.io/component: repo-watcher-controller
+    spec:
+      serviceAccountName: git-k8s-controller
+      containers:
+        - name: controller
+          # ko will replace this with the actual registry image SHA.
+          image: ko://github.com/imjasonh/git-k8s/cmd/repo-watcher-controller
+          env:
+            - name: SYSTEM_NAMESPACE
+              valueFrom:
+                fieldRef:
+                  fieldPath: metadata.namespace
+            - name: POD_NAME
+              valueFrom:
+                fieldRef:
+                  fieldPath: metadata.name
+            - name: CONFIG_LOGGING_NAME
+              value: config-logging
+            - name: CONFIG_OBSERVABILITY_NAME
+              value: config-observability
+          resources:
+            requests:
+              cpu: 100m
+              memory: 128Mi
+            limits:
+              cpu: 500m
+              memory: 256Mi
+          securityContext:
+            allowPrivilegeEscalation: false
+            readOnlyRootFilesystem: true
+            runAsNonRoot: true
+            capabilities:
+              drop:
+                - ALL