refactor(api): move retention and limits under spec.policy

[tdakkota]

Follow-up to #7/#8: nests the freshly-added retention and limits under a spec.policy block that maps 1:1 onto oteldb's storage.policy, as proposed in #3.

spec:
  policy:
    retention:
      maxAge: 720h
    limits:
      maxSeries: 2000000
      maxSeriesSoft: 1500000

The point is that precision, downsample and recompress — the rest of #3 — now have an obvious home, instead of accumulating as more top-level siblings. This is a breaking change to v1alpha1, which is why it's worth doing immediately: spec.retention/spec.limits shipped hours ago, so nothing should be relying on them yet.

Reserved-path hints move with the fields (use spec.policy.retention / use spec.policy.limits); precision/downsample/recompress stay mergeable through extraConfig.

Version caveat, now documented

storage.policy.retention and storage.policy.limits are on oteldb main (oteldb/oteldb@22567d12, closing oteldb/oteldb#1195) but are not in any release — the newest tag, v0.48.0, predates them. oteldb does not decode its config strictly, so against every released build today, including the operator's default v0.46.0 image, these fields are accepted and silently do nothing.

That's the exact failure mode #2 was about, so it's now called out in the PolicySpec godoc, the README and the sample rather than left for a user to discover. Once oteldb cuts a tag, the default image bump makes it work with no API change.

Verification

make test passes at 86.9% coverage, make lint reports 0 issues, make manifests generate && go mod tidy leaves the tree clean.

Also removed two stale deregistered agent worktrees under .claude/worktrees/ (untracked, not part of this diff) that were making golangci-lint's generated-file filter fail and surface spurious zz_generated.deepcopy.go findings.

🤖 Generated with Claude Code