fix: ensure ambient mode is the default in all operator code

[mjnagel]

Description

Updates operator code to ensure Ambient mode is set as the default mode in all places checking pkg.spec.network.serviceMesh.mode.

Related Issue

Known issues in 0.60.0

Type of change

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Other (security config, docs update, etc)

Checklist before merging

• Test, docs, adr added or updated as needed
• Contributor Guide followed

[Copilot]

Pull request overview

This PR standardizes operator behavior so that Ambient is treated as the default service mesh mode whenever spec.network.serviceMesh.mode is omitted, and adjusts tests and sample manifests accordingly.

Changes:

• Updated operator controllers (package-store, authorization policies, waypoint utilities, and ambient waypoint reconciler) to compute an istioMode that defaults to Mode.Ambient when serviceMesh.mode is undefined.
• Adjusted unit tests to reflect Ambient-as-default semantics and to explicitly cover Sidecar behavior in relevant scenarios.
• Updated the test chart package manifest to rely on the default mesh mode instead of explicitly setting serviceMesh.mode: ambient.

Reviewed changes

Copilot reviewed 8 out of 8 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
src/test/chart/templates/package.yaml	Updates the test chart package to rely on the default mesh mode instead of explicitly specifying Ambient.
src/pepr/operator/controllers/packages/package-store.ts	Changes getAmbientPackages to treat missing serviceMesh.mode as Ambient via a defaulted istioMode.
src/pepr/operator/controllers/packages/package-store.spec.ts	Updates tests for getAmbientPackages to assert that packages with empty network are treated as Ambient and that explicit Sidecar remains non-ambient.
src/pepr/operator/controllers/network/authorizationPolicies.ts	Updates findMatchingSsoClient to use a defaulted istioMode so packages without serviceMesh.mode are treated as Ambient.
src/pepr/operator/controllers/network/authorizationPolicies.spec.ts	Adds a Sidecar-mode configuration in an existing test and keeps explicit ambient/sidecar cases for authorization policy behavior.
src/pepr/operator/controllers/istio/waypoint-utils.ts	Updates shouldUseAmbientWaypoint to default istioMode to Ambient when serviceMesh.mode is missing.
src/pepr/operator/controllers/istio/waypoint-utils.spec.ts	Adjusts the test matrix so that a package with no serviceMesh config is expected to use ambient waypoint (Ambient default).
src/pepr/operator/controllers/istio/ambient-waypoint.ts	Updates service and pod reconciliation to gate behavior on a defaulted istioMode, treating missing serviceMesh.mode as Ambient when deciding whether to add waypoint labels.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.