[FEATURE] anyOf conditionPolicy with `defaultStatus == requiredStatus` silently short-circuits rule

[vishnukothakapu]

What happened?

During the review of PR #315, @ajaysundark identified a misconfiguration risk with anyOf rules.

When conditionPolicy is set to anyOf, the rule is satisfied as soon as any single condition matches its requiredStatus. If one of those conditions also defines a defaultStatus equal to its requiredStatus, the controller treats the condition as satisfied whenever it is absent from the Node, because the default value already matches the requirement.

This causes the anyOf evaluation to short-circuit immediately, and the taint is never applied. The misconfiguration is completely silent; nothing in the status or events indicates the rule is effectively a no-op.

Steps to Reproduce

Create a rule with conditionPolicy: anyOf that includes:

yaml

conditions:
  - type: "gpu.example.com/HardwareDriverReady"
    requiredStatus: "True"
    defaultStatus: "True"   # ← matches requiredStatus

If the Node never reports HardwareDriverReady, the controller defaults it to True, which satisfies the anyOf check. The taint is never applied, and the Node appears ready despite the driver never having initialized.

Expected Behavior

The controller should reject this misconfiguration. As discussed with @AnuragThePathak in PR #315, we should:

1. Add a Go webhook validation to reject NodeReadinessRule objects where conditionPolicy is anyOf and any condition's defaultStatus equals its requiredStatus.
2. Update the documentation to explicitly describe this restriction.

Controller Version / Image Tag

main branch / PR #315

Kubernetes Version

N/A

Controller Logs

N/A

Additional Environment Details

This follow-up issue was created based on the post-review discussion in PR #315.

[ajaysundark]

kind/feature

[ajaysundark]

/kind feature
/assign @vishnukothakapu