Clean up PolicyBindings when user invitations are deleted

[scotwells]

Summary

• Wires the existing finalizer into the UserInvitation controller so invitation-related PolicyBindings (getinvitation and acceptinvitation) are deleted before an invitation is removed
• Removes a redundant manual PolicyBinding deletion in the acceptance path since the finalizer now handles cleanup of both bindings
• Adds unit tests verifying finalizer registration and PolicyBinding garbage collection
• Adds an end-to-end Chainsaw test for the full invitation lifecycle

Context

When a UserInvitation was deleted (accepted, expired, or revoked), the associated PolicyBindings in milo-system were left behind because the controller's finalizer was registered but never invoked during reconciliation. This produced 49 orphaned PolicyBindings in production stuck in ResourceSelectorValidationFailed state.

Closes #535

Test plan

• Unit tests verify finalizer is added on first reconcile
• Unit tests verify both PolicyBindings are deleted on UserInvitation deletion
• Existing unit tests updated to account for finalizer registration cycle
• Chainsaw e2e test validates full lifecycle: create invitation → verify PolicyBindings → delete invitation → verify cleanup
• e2e test confirmed to detect the bug in CI (test-only branch failed as expected)

🤖 Generated with Claude Code

[joggrbot]

📝 Documentation Analysis

All docs are up to date! 🎉

---

✅ Latest commit analyzed: 8ae29a2 | Powered by Joggr