Golden image guards check for phase Failed, which a golden import never reaches #4564

The golden image guards look for a DataVolume in phase Failed, and a golden import never gets there in CDI v1.66.1, the version packages/system/kubevirt-cdi-operator/Makefile pins. A golden with a broken URL stays in ImportInProgress for good, so every guard built on Failed lets it through.

These guards key on Failed:

• packages/apps/kubernetes-nodes/templates/nodegroup.yaml refuses a pool whose golden is Failed.
• fix(vm-default-images,kubernetes-worker-image,vm-disk): wait for golden images to import and refuse cloning a failed one #4392 adds the same refusal to packages/apps/vm-disk/templates/dv.yaml.
• The fix for image option source offers golden images whose import failed #4553 drops Failed goldens from the image option source.

CDI marks an import Failed only on a fatal error. updateStatusPhase in pkg/controller/datavolume/import-controller.go at v1.66.1 sets the phase for a failed importer pod only when the PVC carries AnnImportFatalError:

case string(corev1.PodFailed):
    // Only mark as Failed if it's a fatal error (e.g., checksum mismatch).
    // Otherwise, keep the current phase to allow retries.
    if pvc.Annotations[cc.AnnImportFatalError] == "true" {
        dataVolumeCopy.Status.Phase = cdiv1.Failed
    }

The only place that writes this annotation is the checksum mismatch branch in pkg/controller/import-controller.go. The goldens in packages/system/vm-default-images/templates/dv.yaml use a plain http.url with no checksum, so they can never take it. On a 404, a DNS failure or a TLS error the importer exits non-zero, the pod restarts under restartPolicy: OnFailure, and the DataVolume stays ImportInProgress. #4059 describes the same loop for a VMDisk with an HTTP source.

So the picker offers such a golden, vm-disk clones it, and the clone waits forever. The Failed checks are cheap and do no harm. They just cover a case users don't hit.

I don't know the right signal yet. The importer restart count (cdi.kubevirt.io/storage.pod.restarts on the PVC) or the reason of the Running condition on the DataVolume could tell a golden that keeps failing from one that is still downloading. Both need a threshold, and the decision should cover #4059 too.