fix: PolicyBinding status update loop on subject validation failures

[JoseSzycho]

Description:

Root cause

• When subjects were invalid (e.g., User not found), the subject validation helper set Ready=False and immediately wrote status.
• Later in the same Reconcile pass, the main loop also set Ready (with a different, more generic message) and wrote status again.
• Because oldStatus is captured once at the start of Reconcile, both writes looked like real changes. Each write emitted an update event, which re-enqueued the resource and caused another Reconcile. On the next pass, the helper would write its detailed Ready message again, and the main loop would overwrite it—creating a ping‑pong that never converged.

Changes

• Subject validation helper now only sets SubjectValid=False in-memory (Reason=ValidationFailed); it no longer calls Status().Update.
• The main Reconcile path is responsible for setting Ready=False and persisting status once for this failure path.

Impact

• Eliminates redundant status writes and the resulting reconcile thrashing.
• No functional changes to OpenFGA reconciliation.