Fix stale status blocking deployment reconciliation (#551)

## Summary

- Move `ObservedGeneration` assignment before the `DeepEqual` status
diff check in `GrantCreationPolicyReconciler` and
`ClaimCreationPolicyReconciler` so that spec changes which produce the
same validation result still trigger a status update.
- Without this fix, `observedGeneration` never advances when conditions
remain unchanged, causing Flux health checks to permanently report
"InProgress".
- The other quota reconcilers (`ResourceRegistration`, `ResourceGrant`,
`AllowanceBucket`) already follow the correct pattern and required no
changes.

Fixes #550

## Test plan

- [x] Unit tests pass (`task test:unit`)
- [ ] Deploy to test environment and verify `observedGeneration`
advances after a no-op spec change on a `GrantCreationPolicy` or
`ClaimCreationPolicy`
- [ ] Confirm Flux health checks transition to "Ready" after the fix

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Author: scotwells

internal/quota/controllers/policy/claim_creation.go

@@ -78,9 +78,11 @@ func (r *ClaimCreationPolicyReconciler) Reconcile(ctx context.Context, req mcrec
 	// Update policy status based on validation results
 	r.updatePolicyStatus(&policy, validationErrs)
 
-	// Update status if it has changed
+	// Always track the latest generation so the diff captures generation-only changes
+	policy.Status.ObservedGeneration = policy.Generation
+
+	// Only write to the API if something actually changed
 	if !equality.Semantic.DeepEqual(&policy.Status, originalStatus) {
-		policy.Status.ObservedGeneration = policy.Generation
 		if err := clusterClient.Status().Update(ctx, &policy); err != nil {
 			return ctrl.Result{}, fmt.Errorf("failed to update ClaimCreationPolicy status: %w", err)
 		}

internal/quota/controllers/policy/grant_creation.go

@@ -76,10 +76,11 @@ func (r *GrantCreationPolicyReconciler) Reconcile(ctx context.Context, req mcrec
 	// Update policy status based on validation results
 	r.updatePolicyStatus(&policy, validationErrs)
 
-	// Update status if it has changed
-	if !equality.Semantic.DeepEqual(&policy.Status, originalStatus) {
-		policy.Status.ObservedGeneration = policy.Generation
+	// Always track the latest generation so the diff captures generation-only changes
+	policy.Status.ObservedGeneration = policy.Generation
 
+	// Only write to the API if something actually changed
+	if !equality.Semantic.DeepEqual(&policy.Status, originalStatus) {
 		if err := clusterClient.Status().Update(ctx, &policy); err != nil {
 			return ctrl.Result{}, fmt.Errorf("failed to update GrantCreationPolicy status: %w", err)
 		}