docs: add operational best practices guide

[ivankatliarchuk]

What does it do ?

• New docs/advanced/operational-best-practices.md — production readiness checklist and multiple sections
• docs/advanced/domain-filter.md — adds a top-level note clarifying that domain filter flags are application-level intent, not a strict/security enforcement boundary

Motivation

Operational problems — memory bloat from over-scoped informers, crashloops from missing CRDs or RBAC misconfiguration, silent DNS drift, state conflicts amplifying Kubernetes API pressure - are not covered anywhere in the existing docs. Users discover them in production.

Relates

1. PR fix(source): skip sources that fail to initialize instead of crashing #6185 — fix(source): skip sources that fail to initialize instead of crashing (CLOSED)
2. PR feat: add --kube-api-cache-sync-timeout flag for configurable cache sync timeout #6104 — feat: make RequestTimeout configurable for all sources (OPEN)
3. PR WIP feat(source): metric and event for invalid endpoints #6242 — feat(source): metric and event for invalid endpoints (WIP/CLOSED)
4. PR fix(google): do not retry HTTP 409 Conflict errors #6171 — fix(google): do not retry HTTP 409 Conflict errors (DRAFT)
5. PR feat(cloudflare): support batch API for DNS record changes #6208 — feat(cloudflare): support batch API for DNS record changes (MERGED)
6. Issue Potential memory leak in v0.20.0 on linux/arm64 with webhook provider #5965 — Potential memory leak in v0.20.0 on linux/arm64 with webhook provider (memory use)
7. feat: add --include-domains flag for exact FQDN whitelist matching #6140

More

• Yes, this PR title follows Conventional Commits
• Yes, I added unit tests
• Yes, I updated end user documentation accordingly

[coveralls]

Pull Request Test Coverage Report for Build 23196753102

Details

• 0 of 0 changed or added relevant lines in 0 files are covered.
• No unchanged relevant lines lost coverage.
• Overall coverage remained the same at 78.239%

---

Totals
Change from base Build 23186150406:	0.0%
Covered Lines:	16323
Relevant Lines:	20863

---

💛 - Coveralls

[vflaux]

That was an informative read 😃
/lgtm

[ivankatliarchuk]

/approve

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: ivankatliarchuk

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [ivankatliarchuk]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment