Make the generate operation work without audit or webhook #4771

Parent issue: #3964
Related operation cleanup: #4051

What steps did you take and what happened:

Start Gatekeeper with only the documented generation operation:

--operation=generate

The operations documentation says this operation creates Constraint CRDs, ValidatingAdmissionPolicies, and ValidatingAdmissionPolicyBindings. However, operations.HasValidationOperations() excludes operations.Generate, and both the ConstraintTemplate and Constraint controller adders return early when that predicate is false. The reconcilers that own CRD/VAP/VAPB generation therefore never start in generate-only mode.

What did you expect to happen:

The independently selectable generate operation should start the reconciliation paths required to create and clean up CRDs, VAPs, and VAPBs without also enabling audit or an admission webhook.

Generation must not be modeled as an audit or webhook enforcement point merely to satisfy constraint-client initialization. Policy evaluation and resource generation are separate capabilities.

Suggested scope:

• Define an explicit generation/controller capability separate from review enforcement points.
• Register the ConstraintTemplate and Constraint reconciliation paths needed by generate even when audit and webhook are absent.
• Initialize only the compilation/transformation dependencies generation actually needs.
• Preserve Config-based VAP scope synchronization when --sync-vap-enforcement-scope is enabled.
• Keep status aggregation independent; generate-only must not implicitly become a status pod.

Acceptance criteria:

• A generate-only process starts successfully.
• Applying a CEL ConstraintTemplate and matching Constraint in generate-only mode reconciles the Constraint CRD and, on a Kubernetes version with the VAP API, the expected VAP and VAPB.
• Updates and deletions reconcile generated resources correctly.
• Audit and admission webhook servers are not started solely because generate is selected.
• Existing combined audit+generate and webhook+generate behavior remains unchanged.
• Focused tests fail when the old HasValidationOperations() gate is restored.

Environment:

• Gatekeeper version: current master
• Kubernetes version: use a version with admissionregistration.k8s.io/v1 VAP support for the VAP/VAPB assertions