🐛 fix(webhook): keep KollectScope checks when the profile is missing - #307

`validateScope` returned nil as soon as the referenced KollectProfile was
absent, so a KollectTarget applied before its profile skipped the namespace
allow/deny checks and the resourceRules GVK check entirely. PR #304 fixes the
same skip on the cluster-scoped kind; this is the namespaced half.

Severity is lower here than on the cluster kind: `scopeCheck.enforceTarget`
already re-checks GVKs and namespaces at reconcile, so a target admitted this
way degrades instead of collecting. What was wrong is that admission accepted a
spec it can fully evaluate — `deniedNamespaces`, `allowedNamespaces` and
`spec.resourceRules[].gvk` do not depend on the profile at all. Only the profile
`targetGVK` does, and `CollectRuleGVKs` ignores it whenever resourceRules is
non-empty.

The resolve now runs as a switch: found resolves the GVK, NotFound continues
with `profileResolved = false`, any other error still fails closed. GVK
validation is skipped only in the one case where it would compare against a zero
GVK — profile missing *and* no resourceRules — which would otherwise reject a
legal create-before-profile against a non-empty allowedGVKs.

Test first: `TestKollectTargetValidator_scopeAdmissionMissingProfile` covers
denied namespace, out-of-allowlist namespace, and out-of-scope resourceRules GVK
with no profile object present, plus the in-scope case that must stay
admissible. Red before the change on the denied-namespace assertion.

Gates: lint (golangci v2 + arch-lint) clean, verify ok, scrub ok, webhook unit
tests green. envtest suites (TestWebhookEnvtest, TestSetupWithManager_*) do not
run on this host — bin/k8s ships linux-amd64 assets only and setup-envtest is
rate-limited — so they are CI-only, and they fail identically on an unmodified
main checkout here.