bump cocoon-common to v0.2.8

build: align the builder image with the go.mod toolchain

go.mod moved to 1.26.5 but the docker builder stayed on golang:1.25-alpine
with GOTOOLCHAIN=local, so the tag-triggered image build refused to start.

fix: exit non-zero when server run fails

A non-nil return from httpx.Run is a genuine serve failure (bind
conflict, TLS cert error) or shutdown timeout — it filters
http.ErrServerClosed and returns nil on clean signal shutdown. Logging
it at Error and returning left the process exiting 0, so k8s exit-code
alerting, crashloop-backoff, and CI status checks saw success on a
webhook that failed to serve. Use Fatalf to match the setup/keypair/
clientset fatal paths above.

Bump cocoon-common to v0.2.5 (KUBECONFIG list handling; no logic impact on webhook).

fix(deploy): fail closed on the bare-pod gate

pods.mutate exists to deny bare cocoon pods, so failurePolicy Ignore
defeated it whenever the webhook, its CA, or TLS was unavailable. Now
Fail, with a namespaceSelector excluding system namespaces so a webhook
outage cannot wedge cluster-critical pod creation.

fix(metrics): unify fail-open decode as skipped; audit follow-ups

Mutate's fail-open decode recorded result=error while the four identical
fail-open validator decodes record skipped — dashboards on error would
fire for one and miss the others. Rule now encoded in the const block:
fail-open decode = skipped, fail-closed = error. parent-fetch error gains
a reason (contract: "" only for allow/deny). Comment fixes: contract
wording, Reloader/GetCertificate godocs (drop package-doc duplicate and
the false lock-free claim), test helper restatement.

chore(deps): bump cocoon-common to v0.2.2

chore(deps): bump cocoon-common to v0.2.1

style: flatten single-entry const block to bare form

upgrade to latest common, epoch

upgrade to latest common