fix: propagate template.metadata.labels to pods

[bdchatham]

Closes #103.

Summary

Match stock K8s `Deployment` semantics: labels declared on `spec.template.metadata.labels` now land on pods. Prior behavior left them on the child SeiNode CR only, a footgun for anyone reaching for the Deployment mental model.

Change

In `generateSeiNode`, seed `SeiNode.Spec.PodLabels` with `template.metadata.labels`, then overlay `template.spec.podLabels`, then apply system labels. Explicit `podLabels` win on key collision with metadata labels; system labels always win over both.

Tests

Three new cases in `nodes_test.go`:

• `PropagatesTemplateMetadataLabelsToPods` — metadata labels reach `PodLabels`.
• `PodLabelsOverrideTemplateMetadataLabels` — explicit `podLabels` wins on collision.
• `SystemLabelsOverrideUserLabels` — `groupLabel` is unoverrideable.

Existing `PreservesExistingPodLabels` still passes (strict-superset change).

Rollout considerations

• Additive on existing SNDs. Old SNDs without `template.metadata.labels` are unaffected. SNDs that already set them gain the labels on pods on next reconcile — no existing consumer loses labels.
• Selector impact. StatefulSet selectors are immutable, but `spec.selector.matchLabels` only requires a subset match of pod template labels. Adding new labels to pod template is safe; selectors keep working.

Motivation

Surfaced while wiring chaos-mesh selectors for release-6-5 on dev. Intuitive selectors like `sei.io/chain-id: release-6-5` silently matched zero seid pods because the label was on SNDs but not pods. See platform repo chaos-selector workaround PRs for the current hack.

🤖 Generated with Claude Code