OADP-8697: Per-VM backup status for PartiallyFailed namespace backups

[Joeavaikath]

Summary

Track work to expose per-VirtualMachine backup outcome (succeeded / failed / skipped + reason) after namespace-scoped OADP/Velero backups, especially when Backup.status.phase is PartiallyFailed.

Jira: OADP-8697

Design docs: Detailed design is written in the oadp-operator repo (not yet published upstream):

• docs/design/vm_backup_status-design.md — VM case study + cluster evidence
• docs/design/backup_resource_rollup-design.md — generalized approach (preferred)

Problem

Velero reports failures at the raw Kubernetes object level (Backup.status.errors is a count only; detail is unstructured strings in results.gz). Operators cannot tell which VMs succeeded vs failed without manually correlating PVC/DataVolume/VM plugin errors.

Validated on cluster with a 5-VM namespace backup (3 succeeded, 2 failed stale-config VMs). At hundreds/thousands of VMs this is not operable.

Approach

Phased delivery in oadp-cli (no Velero core changes required for v1):

1. Generic backup resource rollup engine: parse Velero metadata + walk ownerReferences to group per-item outcomes
2. kubectl oadp backup resource-status with --group-by=owner:VirtualMachine
3. kubectl oadp backup vm-status as a convenience alias for OADP-8697

VM support is a preset on a workload-agnostic engine, not bespoke KubeVirt parsing.

Acceptance criteria (OADP-8697)

• User can get per-VM status (succeeded / failed / skipped) for a completed/partially-failed backup
• User can see specific failure reason per failed VM (rolled up from dependent resource errors)
• Output is programmatically queryable (-o json/-o yaml) for downstream automation
• Default CLI view is legible at scale: summary line + failures only (not thousands of rows)
• Works when source namespace no longer exists (tarball ownerReferences fallback)

Implementation issues

1. Implement backup resource rollup library (Velero metadata + ownerReference graph) #270 — Backup resource rollup library (pkg/backuprollup)
2. Add kubectl oadp backup resource-status and vm-status commands #271 — CLI: backup resource-status + vm-status (depends on Implement backup resource rollup library (Velero metadata + ownerReference graph) #270)

Out of scope (v1)

• Velero upstream API changes (may follow as separate velero-io proposal)
• In-cluster CRD/controller for persisted rollup status
• Automatic retry or stale-config remediation

Example target UX

$ kubectl oadp backup vm-status oadp-8697-multi-vm-backup
Backup: oadp-8697-multi-vm-backup   Phase: PartiallyFailed
VMs: 5 total   3 succeeded   2 failed   0 skipped

FAILED:
NAME                      NAMESPACE            REASON              DETAIL
vm-broken-baddatasource   oadp-8697-multi-vm   MissingDataSource   ...
vm-broken-orphan-pvc      oadp-8697-multi-vm   MissingPVC          ...