Acknowledge RP-applied Machine labels and taints

[Wenxuan W (wenxuan0923)]

Summary

• Recognize Machine label- and taint-only updates that AKS RP has already reconciled onto the existing Kubernetes Node.
• Persist the new complete goal and ETag without restarting or repaving the nspawn worker.
• Keep non-Node-observable changes, including Kubernetes version and max-pods changes, on the existing fail-closed Node-deletion repave path.
• Validate additions, updates, removals, unrelated Node metadata, omitted scalar defaults, retries, and RP key-wide taint deletion semantics.

Behavior

When the Machine ETag changes, the daemon compares the desired goal with its complete applied goal. It acknowledges in place only when:

• all fields other than custom labels and taints are unchanged;
• every desired label and taint is present on the Node;
• labels and taints removed from the previous goal are absent; and
• the Node is not being deleted.

Otherwise, the daemon continues returning WaitForNodeSignal and requires the existing Node-deletion signal before blue-green repave.

Direct ARM Machine status is currently read-only, so ARM mode persists local convergence while skipping the status mutation.

Validation

• go test ./...
• go test -race ./pkg/daemon
• go vet ./...
• golangci-lint run --timeout=5m (0 issues)
• Real Azure VM E2E in eastus2euap against RP frontend v20260807.260816.1:
  • RP reconciled Machine labels and taints onto the live Node.
  • Agent selected AcknowledgeGoalState and advanced the applied ETag without changing Node UID, active nspawn side, or leader PID.
  • A subsequent Kubernetes-version goal selected WaitForNodeSignal, then repaved kube1 to kube2 only after Node deletion.
  • Final kubelet version was v1.36.3; all test resources were deleted.