fix: add nil safety checks and immutability validation

[Swaraj-do]

What this PR does / why we need it

This PR resolves several critical nil-pointer dereference vulnerabilities and enforces immutability validation across the TrainJob controller, admission webhooks, and runtime plugins:

1. ReplicatedJob & Runtime Nil Safety (pkg/runtime & jobset plugin):

   • Adds nil-pointer guards in ExtractResourcePerNodeFromRuntime and JobSet.Validate to safely handle minimal or malformed ReplicatedJob specifications without triggering controller panics.
   • Prevents crashes when processing empty or partial job templates.

2. Controller Status Preservation (pkg/controller/trainjob_controller.go):

   • Adds nil runtime guards in setTrainJobStatus.
   • Preserves pre-existing status conditions accumulated during reconciliation iterations rather than overwriting them.

3. runtimeRef Immutability Validation (pkg/webhooks/trainjob_webhook.go):

   • Enforces validation in the TrainJob admission webhook ensuring spec.runtimeRef cannot be modified during updates after creation.

4. TorchTune Plugin Guards (pkg/runtime/framework/plugins/torch/torchtune.go):

   • Safely handles nil spec.trainer inside validateTorchTune and getRecipeAndConfig, preventing admission webhook panics when trainer fields are absent.

5. Comprehensive Unit Test Coverage:

   • Adds dedicated unit tests across trainjob_controller_test.go, jobset_test.go, torchtune_test.go, runtime_test.go, and trainjob_webhook_test.go to prevent regressions.

---

Checklist

• Title follows conventional commit format (fix: ...)
• Code complies with project style and guidelines
• Unit tests included for all modified components (go test ./pkg/...)
• DCO Signed-off on all commits

[google-oss-prow]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign jeffwan for approval. For more information see the Kubernetes Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[github-actions]

🎉 Welcome to the Kubeflow Trainer! 🎉

Thanks for opening your first PR! We're happy to have you as part of our community 🚀

Here's what happens next:

• If you haven't already, please check out our Contributing Guide for repo-specific guidelines and the Kubeflow Contributor Guide for general community standards.
• Our team will review your PR soon! cc @kubeflow/kubeflow-trainer-team

Join the community:

• Slack: Join our #kubeflow-trainer Slack channel.
• Meetings: Attend the Kubeflow AutoML and Training Working Group bi-weekly meetings.

Feel free to ask questions in the comments if you need any help or clarification!
Thanks again for contributing to Kubeflow! 🙏