Move all pre-loop client I/O (ZK ConfigMap, OPA URL, S3 connection, deep
storage bucket, AuthenticationClasses) into a new
`controller::dereference` submodule that returns `DereferencedObjects`.

Matches the trino-operator pattern (trino-operator commit 7004062).
No behavior change.

Move pure validation (product image resolution, TLS security construction,
authentication config conversion, product-config validation) into a new
`controller::validate` submodule that returns `ValidatedInputs`.

Matches the trino-operator pattern (trino-operator commit 7004062).
No behavior change.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Follow-up to the druid_controller → controller module rename.

Move the StatefulSet and PodDisruptionBudget shape assertions into
the upcoming 52-assert (resource shape) so that 50-assert mirrors
trino-operator's 10-assert (readiness-only). The duplicated broker
PDB and missing coordinator PDB will be corrected in 52-assert.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Declarative shape assertions for every operator-managed druid
resource in the smoke test (5 StatefulSets, 3 ClusterIP + 5 headless
Services, 3 Listeners, 5 PDBs, the shared internal Secret, the
ServiceAccount, and the RoleBinding). Mirrors trino's 13-assert
and kafka's 33-assert.yaml.j2 patterns. The duplicative *-metrics
Services are intentionally not asserted.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Fill in the bare log-config/log volume entries on the historical
StatefulSet so the assertion matches the live shape, and add the
selector blocks on the five headless Services (mirrors the
trino/kafka equivalents). Also clarify the vector_enabled comment.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

First slice of the ConfigMap snapshot assertion: the discovery
ConfigMap and the operator-managed Secret's key presence. The five
role-group ConfigMap snapshots follow in the next commit.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Adds full .data snapshots for druid-{broker,coordinator,historical,
middlemanager,router}-default ConfigMaps. The actual side is
normalized for namespace and the random znode UUID before diffing.
The current snapshot was captured with VECTOR_AGGREGATOR unset.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

vector_enabled was declared in 52-assert.yaml.j2 as forward
scaffolding but has no consumer. Drop it; it can be re-introduced
in the commit that actually uses it.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

The previous check listed druid-router-default-0 twice and never
checked druid-broker-default-0. Replace the duplicate with the
broker entry and sort the list by role name for readability.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

When VECTOR_AGGREGATOR is set, the operator adds a vector.yaml key
to each role-group ConfigMap; the other four keys are unchanged.
The vector.yaml payload is the same across all five roles except
for a single `.role = "<role>"` line, so the content is declared
once via a jinja2 `{% set %}` block and substituted per role inside
the heredoc.

Verified against a live VECTOR_AGGREGATOR=vector-aggregator-discovery
cluster in namespace kuttl-test-distinct-camel.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

The `{% if vector_enabled -%}` and `{%- endif %}` blocks had
6 leading spaces. When vector_enabled was false, jinja2's strip
markers joined the leading whitespace of both blocks, putting
YAMLEOF at 12 spaces in the rendered output. After the kuttl
YAML block scalar strips 6 common-leading spaces, YAMLEOF ended
up at 6 spaces inside the script body, but the heredoc opener
is `<<'YAMLEOF'` (not `<<-`), which requires the terminator at
column 0. The heredoc therefore never closed and `\$(...)` never
terminated, producing `Syntax error: end of file unexpected
(expecting ")")` from dash.

Moving `{% if %}` and `{% endif %}` to column 0 (no strip markers)
mirrors kafka-operator's 34-assert.yaml.j2 pattern and renders
both branches with YAMLEOF at the correct indent.

Verified:
- non-vector render: 8 scripts pass against
  kuttl-test-fluent-mastodon
- vector render heredoc parses to the 5 expected keys
  (jvm.config, log4j2.properties, runtime.properties,
  security.properties, vector.yaml)

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>