fix: reconcile aggregator PDB last to not block HPA on failure

[aa1ex]

Follow-up to #229.

The PDB step ran before the event collector and HPA steps, so a rejected PDB write (admission policy, quota, RBAC) aborted the reconcile and left the aggregator without autoscaling until the write recovered. Now it runs last; the failure is still reported and retried. Verified on a live cluster with an admission policy denying PDB writes: the HPA is created while the PDB retries.

Along the way: field docs now state that minAvailable wins when both minAvailable and maxUnavailable are set (CRDs regenerated, helm mirrored), and unit tests for the PDB and HPA reconcile gates plus a regression test for the new ordering. To make the gates testable, Controller.ClientSet and configcheck.New take kubernetes.Interface now; callers are unchanged.