fix: move MCPServer deletion check before validation and external API calls

[muratclk]

Summary

Moves the GetDeletionTimestamp() check and finalizer handling to run immediately after fetching the MCPServer resource, before any validation or external API calls.

Fixes #4631

Problem

The MCPServer Reconcile method performed 10+ operations including external API calls before checking if the resource was marked for deletion:

1. handleRestartAnnotation
2. validateGroupRef — fetches MCPGroup
3. validateCABundleRef — validates CA bundles
4. validateStdioReplicaCap / validateSessionStorageForReplicas
5. validateAndUpdatePodTemplateStatus
6. handleToolConfig — fetches MCPToolConfig
7. handleTelemetryConfig — fetches MCPTelemetryConfig
8. handleExternalAuthConfig — fetches MCPExternalAuthConfig
9. handleOIDCConfig — fetches MCPOIDCConfig
10. Image validation against registries

This caused unnecessary work during deletion and, critically, validation failures could block deletion entirely.

Fix

Reordered the reconciliation flow to:

fetch → check deletion → add finalizer → validate → reconcile

The deletion check and finalizer logic now run right after the initial resource fetch, so none of the validation or external API calls are executed for resources being deleted.

Test plan

• Existing unit tests pass (no behavioral change for non-deletion path)
• Deletion with finalizer still runs finalization logic and removes finalizer
• Deletion without finalizer returns immediately
• Non-deletion path still validates and reconciles as before

[ChrisJBurns]

HI @muratclk this has been fixed now