PCP-6413: Use PV/SC mapper for volumeName and storageClassName in PVC syncer

[ChellaVigneshKP]

What issue type does this pull request address? (keep at least one, remove the others)
/kind bugfix

What does this pull request do? Which issues does it resolve? (use resolves #<issue_number> if possible)

The PVC syncer's translateSelector function calls translate.Default.HostNameCluster() directly to translate volumeName and storageClassName, bypassing the PV and SC mappers. This unconditionally mangles these names even when the PV was synced from the host (hasvcluster.loft.sh/host-pv annotation), making it impossible to bind a PVC to a pre-existing host PV by name.
Additionally, the PV syncer's translate function has the same pattern for storageClassName, causing SC name mismatches between PVs and PVCs on the host when toHost.storageClasses.enabled is false.
This fix replaces 5 instances of HostNameCluster() with mappings.VirtualToHostName() across 2 files, routing through the proper mappers which conditionally translate based on resource origin — host-synced resources retain their original names, vCluster-created resources still get translated normally.

Please provide a short message that should be published in the vcluster release notes
Fixed an issue where vCluster unconditionally mangled volumeName and storageClassName when syncing PVCs to the host, even for PVs synced from the host with the vcluster.loft.sh/host-pv annotation. PVCs with explicit volumeName pointing to a pre-existing host PV nowbind correctly.

What else do we need to know?
The PV mapper (pkg/mappings/resources/persistentvolumes.go:18-29) already had the correct annotation-aware logic — this fix simply ensures the PVC and PV syncers use it instead of bypassing it.
The fix also addresses the PV syncer's storageClassName translation (persistentvolumes/translate.go:20) to prevent SC name mismatches between PVs and PVCs on the host when toHost.storageClasses.enabled is false (mirror mapper scenario).

E2E Tests

Default Test Execution

The mandatory PR suite runs automatically. Only specify additional test suites below if needed.

Adding New Test Suites

When adding a new ginkgo test suite:

• Add labels to the test suite
• Update label-filter section below to execute the new test suite
• Verify test suite runs in CI/CD pipeline

Additional test suites

Additional test suite(s) that will be executed before the mandatory PR suite:

none

[bulwark-spectrocloud]

⚠️ GoVulnCheck scan found vulnerabilities:

1. GO-2025-3774
   • Module: k8s.io/kubernetes
   • Found in: v1.32.1
   • Fixed in: v1.32.6
   • Example Traces:
     1. pkg/kubeadm/config.go:11:70: kubeadm.InitKubeadmConfig calls config.DefaultedStaticInitConfiguration, which eventually calls conversion.Convert
     2. pkg/kubeadm/config.go:11:70: kubeadm.InitKubeadmConfig calls config.DefaultedStaticInitConfiguration, which eventually calls conversion.Convert
     3. pkg/certs/ensure.go:472:24: certs.BuildKubeConfig calls pkiutil.EncodeCertPEM, which eventually calls certs.BuildKubeConfig
     4. pkg/kubeadm/config.go:11:70: kubeadm.InitKubeadmConfig calls config.DefaultedStaticInitConfiguration, which eventually calls conversion.Convert
     5. pkg/kubeadm/config.go:6:2: kubeadm.init calls config.init, which eventually calls scheme.init
2. GO-2026-4394
   • Module: go.opentelemetry.io/otel/sdk
   • Found in: v1.33.0
   • Fixed in: v1.40.0
   • Example Traces:
     1. pkg/server/server.go:52:2: server.init calls apiserver.init, which eventually calls trace.init
     2. pkg/server/server.go:44:2: server.init calls options.init, which eventually calls resource.init
     3. pkg/plugin/v1/remote/plugin_grpc.pb.go:235:20: remote.Mutate calls grpc.Invoke, which eventually calls otelgrpc.Event
     4. pkg/server/filters/metrics.go:384:13: filters.ExecuteRequest calls proxy.ServeHTTP, which eventually calls otelhttp.RoundTrip
     5. pkg/server/filters/metrics.go:384:13: filters.ExecuteRequest calls http.ServeHTTP, which eventually calls otelhttp.serveHTTP
3. GO-2025-4240
   • Module: k8s.io/kubernetes
   • Found in: v1.32.1
   • Fixed in: v1.32.10
   • Example Traces:
     1. pkg/kubeadm/config.go:11:70: kubeadm.InitKubeadmConfig calls config.DefaultedStaticInitConfiguration, which eventually calls conversion.Convert
     2. pkg/kubeadm/config.go:11:70: kubeadm.InitKubeadmConfig calls config.DefaultedStaticInitConfiguration, which eventually calls conversion.Convert
     3. pkg/cli/start/start.go:31:32: start.init calls runtime.AddToScheme, which eventually calls runtime.AddToScheme
     4. pkg/kubeadm/config.go:11:70: kubeadm.InitKubeadmConfig calls config.DefaultedStaticInitConfiguration, which eventually calls conversion.Convert
     5. pkg/kubeadm/config.go:6:2: kubeadm.init calls config.init, which eventually calls config.init
4. GO-2025-3915
   • Module: k8s.io/kubernetes
   • Found in: v1.32.1
   • Fixed in: v1.32.8
   • Example Traces:
     1. pkg/controllers/resources/pods/translate/translator.go:672:13: translate.TranslateContainerEnv calls sort.Slice, which eventually calls sort.pdqsort_func
     2. pkg/certs/ensure.go:104:30: certs.EnsureCerts calls certs.CreatePKIAssets, which eventually calls certs.CreateTree
     3. pkg/kubeadm/config.go:6:2: kubeadm.init calls config.init, which eventually calls componentconfigs.init
     4. pkg/syncer/testing/testing.go:63:71: testing.Setup calls output.DeepCopyObject, which eventually calls testing.Setup
     5. pkg/kubeadm/config.go:11:70: kubeadm.InitKubeadmConfig calls config.DefaultedStaticInitConfiguration, which eventually calls conversion.Convert
5. GO-2025-3922
   • Module: github.com/ulikunitz/xz
   • Found in: v0.5.11
   • Fixed in: v0.5.15
   • Example Traces:
     1. pkg/server/filters/metrics.go:395:34: filters.ExecuteRequest calls io.ReadAll, which eventually calls xz.readUvarint
     2. pkg/server/filters/metrics.go:395:34: filters.ExecuteRequest calls io.ReadAll, which eventually calls xz.UnmarshalBinary
     3. pkg/server/filters/metrics.go:395:34: filters.ExecuteRequest calls io.ReadAll, which eventually calls xz.newStreamReader
     4. pkg/upgrade/upgrade.go:141:25: upgrade.Upgrade calls selfupdate.UpdateTo, which eventually calls selfupdate.UncompressCommand
     5. pkg/upgrade/upgrade.go:16:2: upgrade.init calls selfupdate.init, which eventually calls lzma.init
6. GO-2026-4762
   • Module: google.golang.org/grpc
   • Found in: v1.67.1
   • Fixed in: v1.79.3
   • Example Traces:
     1. pkg/plugin/v1/plugin.go:232:2: v1.Start calls v1.Start$1, which eventually calls v1.Start$1
7. GO-2026-4550
   • Module: github.com/cloudflare/circl
   • Found in: v1.6.1
   • Fixed in: v1.6.3
   • Example Traces:
     1. pkg/platform/version.go:11:2: platform.init calls github.init, which eventually calls ed25519.init
     2. pkg/platform/version.go:11:2: platform.init calls github.init, which eventually calls ed448.init
     3. pkg/platform/version.go:11:2: platform.init calls github.init, which eventually calls ecc.init
     4. pkg/platform/version.go:11:2: platform.init calls github.init, which eventually calls ecc.init
     5. pkg/platform/version.go:11:2: platform.init calls github.init, which eventually calls goldilocks.init

Please review these findings and fix the issues before merging.

[bulwark-spectrocloud]

⚠️ GoSec scan found code issues:

1. G115: integer overflow conversion rune -> byte, Severity: HIGH
   • 1. File: /home/runner/_work/bulwark/bulwark/target-repo/pkg/util/patch/path.go:48:40
   • 2. File: /home/runner/_work/bulwark/bulwark/target-repo/pkg/controllers/resources/nodes/nodeservice/node_service.go:151:38
   • 3. File: /home/runner/_work/bulwark/bulwark/target-repo/pkg/apiservice/generic.go:115:28
   • 4. File: /home/runner/_work/bulwark/bulwark/target-repo/pkg/apiservice/generic.go:97:17
   • 5. File: /home/runner/_work/bulwark/bulwark/target-repo/cmd/vcluster/cmd/portforward.go:209:84
2. G404: Use of weak random number generator (math/rand or math/rand/v2 instead of crypto/rand), Severity: HIGH
   • 1. File: /home/runner/_work/bulwark/bulwark/target-repo/pkg/util/random/rand.go:13:22
   • 2. File: /home/runner/_work/bulwark/bulwark/target-repo/pkg/util/clihelper/clihelper.go:174:17
   • 3. File: /home/runner/_work/bulwark/bulwark/target-repo/pkg/util/clihelper/clihelper.go:166:19
   • 4. File: /home/runner/_work/bulwark/bulwark/target-repo/pkg/platform/random/random.go:13:22
3. G402: TLS InsecureSkipVerify set to true., Severity: HIGH
   • 1. File: /home/runner/_work/bulwark/bulwark/target-repo/pkg/util/http/transport.go:17:65
   • 2. File: /home/runner/_work/bulwark/bulwark/target-repo/pkg/cli/start/success.go:129:25
   • 3. File: /home/runner/_work/bulwark/bulwark/target-repo/pkg/cli/start/login.go:76:52
4. G109: Potential Integer overflow made by strconv.Atoi result conversion to int16/32, Severity: HIGH
   • 1. File: /home/runner/_work/bulwark/bulwark/target-repo/pkg/lifecycle/lifecycle.go:346:17
   • 2. File: /home/runner/_work/bulwark/bulwark/target-repo/pkg/lifecycle/lifecycle.go:300:17
   • 3. File: /home/runner/_work/bulwark/bulwark/target-repo/cmd/vcluster/cmd/portforward.go:209:79
5. G401: Use of weak cryptographic primitive, Severity: MEDIUM
   • 1. File: /home/runner/_work/bulwark/bulwark/target-repo/pkg/snapshot/s3/store.go:181:11
   • 2. File: /home/runner/_work/bulwark/bulwark/target-repo/pkg/controllers/deploy/deploy.go:457:27
6. G501: Blocklisted import crypto/md5: weak cryptographic primitive, Severity: MEDIUM
   • 1. File: /home/runner/_work/bulwark/bulwark/target-repo/pkg/snapshot/s3/store.go:21:2
   • 2. File: /home/runner/_work/bulwark/bulwark/target-repo/pkg/controllers/deploy/deploy.go:5:2

Please review these findings and fix the issues before merging.

[shubhamrajvanshi]

@ChellaVigneshKP you might have to push this fix to upstream as we use the upstream vcluster binary