fix(updateops): handle deletion before mutual-exclusion check

[zmberg]

Summary

• Move the DeletionTimestamp check before the mutual-exclusion check in SandboxUpdateOps reconciler, so that a deleting ops is not blocked from finalizer removal by another active ops in the same namespace.
• Previously, when another SandboxUpdateOps was in Updating phase, the controller would skip reconciliation entirely — including deletion handling. This caused finalizer removal to be delayed until the active ops completed (up to hours in production).

Test plan

• Unit test TestReconcile_DeletionNotBlockedByActiveOps: verifies deletion proceeds while another ops is Updating
• E2E test: creates two ops in the same namespace, verifies the completed one can be deleted promptly while the other is stuck in Updating

🤖 Generated with Claude Code

[kruise-bot]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please ask for approval from zmberg by writing /assign @zmberg in a comment. For more information see:The Kubernetes Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 79.67%. Comparing base (c1cb28c) to head (7da5de5).

Additional details and impacted files

@@           Coverage Diff           @@
##           master     #564   +/-   ##
=======================================
  Coverage   79.67%   79.67%           
=======================================
  Files         194      194           
  Lines       13784    13784           
=======================================
  Hits        10983    10983           
  Misses       2403     2403           
  Partials      398      398           

Flag	Coverage Δ
unittests	79.67% <100.00%> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.