Implement a mutating admission webhook to inject a sidecar container into pods

Steps

1. Scaffold a mutating webhook with `kubebuilder create webhook` and select `--defaulting` to generate the `Default()` method
2. In `Default()`, deserialize the pod spec from the admission request, append the sidecar container to `spec.containers`, and return a JSON patch
3. Use `admission.PatchResponseFromRaw` or build `jsonpatch.JsonPatchOperation` entries for the mutation response
4. Register the webhook in a `MutatingWebhookConfiguration` with `reinvocationPolicy: IfNeeded` if the sidecar depends on other mutating webhooks running first
5. Set `namespaceSelector` to target only labeled namespaces to avoid mutating system namespaces
6. Verify injection by creating a pod in a labeled namespace and inspecting `kubectl get pod -o yaml` for the injected container