feat(webhook): ImpVMClass validator stub

Registration stub implementing admission.Validator[*ImpVMClass]; all
three methods return nil. Numeric field minimums are enforced by CEL
markers on the CRD schema; immutability checks will follow in Phase 2.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: syscod3

internal/webhook/v1alpha1/impvmclass_webhook.go

@@ -0,0 +1,48 @@
+/*
+Copyright 2026.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package v1alpha1
+
+import (
+	"context"
+
+	"sigs.k8s.io/controller-runtime/pkg/webhook/admission"
+
+	impdevv1alpha1 "github.com/syscode-labs/imp/api/v1alpha1"
+)
+
+// ImpVMClassWebhook validates ImpVMClass objects.
+// Numeric field minimums (VCPU≥1, MemoryMiB≥128, DiskGiB≥1) are enforced by
+// CEL validation markers on the CRD schema; this webhook is a registration
+// stub that will hold immutability checks in Phase 2.
+type ImpVMClassWebhook struct{}
+
+var _ admission.Validator[*impdevv1alpha1.ImpVMClass] = &ImpVMClassWebhook{}
+
+// ValidateCreate implements admission.Validator[*impdevv1alpha1.ImpVMClass].
+func (w *ImpVMClassWebhook) ValidateCreate(_ context.Context, _ *impdevv1alpha1.ImpVMClass) (admission.Warnings, error) {
+	return nil, nil
+}
+
+// ValidateUpdate implements admission.Validator[*impdevv1alpha1.ImpVMClass].
+func (w *ImpVMClassWebhook) ValidateUpdate(_ context.Context, _, _ *impdevv1alpha1.ImpVMClass) (admission.Warnings, error) {
+	return nil, nil
+}
+
+// ValidateDelete implements admission.Validator[*impdevv1alpha1.ImpVMClass].
+func (w *ImpVMClassWebhook) ValidateDelete(_ context.Context, _ *impdevv1alpha1.ImpVMClass) (admission.Warnings, error) {
+	return nil, nil
+}

internal/webhook/v1alpha1/impvmclass_webhook_test.go

@@ -0,0 +1,71 @@
+/*
+Copyright 2026.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package v1alpha1
+
+import (
+	"context"
+	"testing"
+
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+
+	impdevv1alpha1 "github.com/syscode-labs/imp/api/v1alpha1"
+)
+
+// newClass builds a minimal ImpVMClass for use in tests.
+func newClass(vcpu, memMiB, diskGiB int32) *impdevv1alpha1.ImpVMClass {
+	return &impdevv1alpha1.ImpVMClass{
+		ObjectMeta: metav1.ObjectMeta{
+			Name: "test-class",
+		},
+		Spec: impdevv1alpha1.ImpVMClassSpec{
+			VCPU:      vcpu,
+			MemoryMiB: memMiB,
+			DiskGiB:   diskGiB,
+		},
+	}
+}
+
+func TestImpVMClassWebhook_ValidateCreate(t *testing.T) {
+	wh := &ImpVMClassWebhook{}
+	cls := newClass(2, 256, 10)
+
+	_, err := wh.ValidateCreate(context.Background(), cls)
+	if err != nil {
+		t.Errorf("expected no error for valid class, got: %v", err)
+	}
+}
+
+func TestImpVMClassWebhook_ValidateUpdate(t *testing.T) {
+	wh := &ImpVMClassWebhook{}
+	oldCls := newClass(2, 256, 10)
+	newCls := newClass(4, 512, 20)
+
+	_, err := wh.ValidateUpdate(context.Background(), oldCls, newCls)
+	if err != nil {
+		t.Errorf("expected no error on update, got: %v", err)
+	}
+}
+
+func TestImpVMClassWebhook_ValidateDelete(t *testing.T) {
+	wh := &ImpVMClassWebhook{}
+	cls := newClass(2, 256, 10)
+
+	_, err := wh.ValidateDelete(context.Background(), cls)
+	if err != nil {
+		t.Errorf("expected no error on delete, got: %v", err)
+	}
+}