Fix provider reconciler update loop

[ruibaby]

What

• Avoid updating an AiProvider when its finalizer is already present.
• Add regression coverage for idempotent provider reconciliation.

Why

AiProviderReconciler previously updated every non-deleted provider during each reconciliation, even when addFinalizers made no change. Since provider updates enqueue another reconciliation, this could create a continuous update loop and repeatedly invalidate cached provider clients.

How to test

./gradlew build
git diff --check