fix(poolautoscaler): reject when policy cannot reach min replicas

[ywExcellent]

Ⅰ. Describe what this PR does

Rejects (HTTP 422) PoolAutoscaler capacity policies that cannot scale an idle pool down to minReplicas, instead of only returning an admission warning that users may never see.

The check evaluates the upper watermark at minReplicas + 1 replicas with the same rounding and default-tolerance semantics as the controller, so validation matches runtime behavior.

The error message explains the final scale-down step concretely instead of exposing the percentage formula:

cannot scale down to minReplicas 1: with 2 replicas, the upper watermark is 3 but must be at most 1; please lower targetAvailable or tolerance

Also updates the proposal with the plain-language rule, the equivalent formulas, and accepted/rejected configuration examples.

Ⅱ. Does this pull request fix one issue?

NONE

Ⅲ. Describe how to verify it

go test -mod=readonly ./pkg/webhook/poolautoscaler/validating -count=1

• targetAvailable: "100%" / "99%" with minReplicas: 1 are rejected with 422.
• targetAvailable: "40%" (default tolerance) with minReplicas: 1 is accepted.
• targetAvailable: 1 with tolerance: 0 is accepted.
• The rejection message reports the calculated upper watermark and the required maximum.

Ⅳ. Special notes for reviews

• Behavior change: previously these configurations only produced an admission warning; they are now rejected on create/update (failurePolicy=fail). Existing PoolAutoscalers with such policies must be corrected before their next update.
• The webhook reuses the controller's watermark semantics (combine percentages before rounding up, default tolerance 10%), keeping validation and runtime consistent.
• No API schema, controller watermark, or cooldown changes.

[kruise-bot]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign furykerry for approval by writing /assign @furykerry in a comment. For more information see:The Kubernetes Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• docs/OWNERS
• pkg/webhook/OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[codecov]

Codecov Report

❌ Patch coverage is 96.77419% with 1 line in your changes missing coverage. Please review.
✅ Project coverage is 83.07%. Comparing base (a2ba80c) to head (30e323c).
⚠️ Report is 18 commits behind head on master.

Files with missing lines	Patch %	Lines
...olautoscaler/validating/poolautoscaler_validate.go	96.77%	1 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##           master     #931      +/-   ##
==========================================
+ Coverage   82.68%   83.07%   +0.39%     
==========================================
  Files         256      259       +3     
  Lines       21775    22592     +817     
==========================================
+ Hits        18005    18769     +764     
- Misses       3071     3106      +35     
- Partials      699      717      +18     

Flag	Coverage Δ
unittests	83.07% <96.77%> (+0.39%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.