Summary

This reworks ResourceOperations into the primary, idiomatic API for create/update/patch operations that keep the informer cache read-after-write consistent and control how the resulting own event is handled. Every operation comes in a
default flavor and an Options-taking flavor, so users can tune caching vs. own-event filtering per call.

Own-event filtering is only correct when the framework can distinguish an own write from a concurrent third-party write. This PR makes that requirement explicit through a small strategy model (Options → Mode) and a pluggable Matcher
framework with sensible per-operation defaults.

Options / Mode

• matchAndFilter(matcher) / matchAndFilterWithDefaultMatcher(updateType) — compare desired vs. actual (cached) state; skip the write entirely if they already match, otherwise write and filter the own event. This is the default for the
  update/patch methods and the most efficient option (filters and avoids a needless API call).
• filterWithOptimisticLocking() — filter the own event; the write must use optimistic locking (a resourceVersion set), otherwise an IllegalArgumentException is thrown. Guarantees a concurrent change is rejected server-side rather than
  silently filtered out.
• cacheOnly() — only cache the response (read-after-write consistency), no own-event filtering.
• forceFilterEvents() — always filter (mostly internal; safe only when correctness is otherwise guaranteed).

Matcher framework

• New Matcher interface plus default matchers for every UpdateType (UPDATE, SSA, JSON_PATCH, JSON_MERGE_PATCH, and their *_STATUS variants), backed by MatcherUtils.
• GenericKubernetesResourceMatcher.matchStatus(...) added to match only the /status subtree (tolerating server-added fields by default).

Framework integration

• Finalizer handling (ReconciliationDispatcher): the finalizer is now added with cacheOnly (its own event is no longer filtered), replacing the previous filter + INSTANT_RESCHEDULE so the finalizer-add event itself drives the follow-up
  reconcile.
• Primary UpdateControl writes now use cacheOnly, trading one extra self-triggered reconcile for correctness (a concurrent spec change during a status patch can no longer be absorbed by the own-event filter).
• KubernetesDependentResource create/SSA now use forceFilterEvents().
• AbstractExternalDependentResource persists explicit state through resourceOperations().create(...).

Tests & docs

• New ITs covering the concurrency and read-after-write edge cases: ResourceOperationsIT, SecondaryResourceOperationsIT, SpecChangeDuringStatusPatchIT, OwnSsaStatusUpdateIT, plus expanded ResourceOperationsTest, PatchMatchersTest,
  StatusMatchersTest.
• Adjusted existing tests to the new event cadence (e.g. SubResourceUpdateIT, WorkflowMultipleActivationIT now snapshot reconcile counts only after they stabilize).
• Docs updated: reconciler.md, v5-5-migration.md, v5-5-release.md, and the read-after-write blog post.

Notes / follow-ups

• The Options API is marked @Experimental (API may change).
• Default matchers are heuristics — reconcilers relying on them should be tested against their concrete resources, or supply a custom Matcher.