Fix metadata-webhook cleanup race condition (#3973)

* Limit metadata-webhook scope to serving-tests namespace

Add namespaceSelector to the MutatingWebhookConfiguration to limit
the webhook's scope to namespaces with the samples.knative.dev/release
label. This prevents the webhook from blocking resource deletions in
other namespaces when the serving-tests namespace is torn down.

The issue occurred during upgrade test cleanup where the Route resource
for deployment-upgrade-failure could not be deleted because the webhook
service was unavailable after namespace cleanup started.

Assisted-by: 🤖 Claude Opus/Sonnet 4.5

* Fix metadata-webhook cleanup race condition

Delete webhook resources before namespace deletion to prevent blocking
Route finalizer removal when webhook service is unavailable.

The issue occurs when:
1. Tests complete and cleanup starts
2. 'kubectl delete ns serving-tests' begins namespace deletion
3. Routes have finalizers that need removal
4. Finalizer removal triggers the MutatingWebhookConfiguration
5. Webhook service (in serving-tests) is already being deleted
6. Webhook call times out, blocking namespace deletion

Solution: Delete the webhook resources (including the cluster-scoped
MutatingWebhookConfiguration) before deleting the serving-tests namespace.
This mirrors the installation order and prevents the race condition.

* Add --ignore-not-found to namespace deletion

The webhook config directory includes 100-namespace.yaml which deletes
the serving-tests namespace. Adding --ignore-not-found prevents the
error when the namespace is already deleted.

Author: cardil

test/lib.bash

@@ -571,8 +571,16 @@ EOF
       --upgradeopenshift
   fi
 
-  # Delete the leftover namespace.
-  oc delete namespace serving-tests
+  # Delete metadata-webhook resources before deleting the namespace.
+  # This prevents blocking Route finalizer removal when webhook service is unavailable.
+  if [[ $MESH == "true" ]]; then
+    local rootdir
+    rootdir="$(dirname "$(dirname "$(realpath "${BASH_SOURCE[0]}")")")"
+    oc delete -f "${rootdir}/serving/metadata-webhook/config" --ignore-not-found
+  fi
+
+  # Delete the leftover namespace (may already be deleted by webhook config cleanup).
+  oc delete namespace serving-tests --ignore-not-found
 
   logger.success 'Upgrade tests passed'
 }