Give pods skipped for a VPA a signal that outlives the event

The VPAManagesLimit warning is the only sign that a VPA is keeping Headroom off a pod. It fires once per pod and VPA, and again only after a controller restart, while Kubernetes keeps events for one hour by default (not measured here). After that, nothing says why the pod has no ceiling, or a ceiling Headroom no longer moves. No metric counts these pods, and a pod Headroom managed earlier still carries a kube-headroom.dev/status annotation that reads as current, since internal/controller/node_controller.go:228:status := buildPodStatus runs only for managed pods.

The likely shape is a per-node gauge beside headroom_node_managed_pods, and scripts/preflight-namespaces.sh could list the VPAs in a namespace before it is enrolled. Decide whether the stale annotation should be cleared at the same time, because opting a pod out leaves the same stale annotation.

A failing VPA list has the same gap: one error line per process and no metric, however long it lasts, while a controller restarted during the failure reads every pod as free of VPAs. Cover it with the same work.