Avoid propagating ApplySet labels to owned resources

[BjarkeTornager]

Summary

• exclude labels in the applyset.kubernetes.io/ namespace when propagating RestateDeployment labels
• apply the filter to versioned Services and Knative Configurations/Routes
• retain all ordinary user labels
• document the behavior change

Why

kubectl adds applyset.kubernetes.io/part-of to resources applied with --applyset. Copying it to an operator-owned versioned Service makes that Service look like a direct ApplySet member. When the same ApplySet contains the Service kind, a later prune can delete the versioned Service before Restate has drained that deployment.

Because the children are server-side applied by the operator, a reconciliation after upgrade also removes labels that older operator versions propagated.

Validation

• cargo fmt --check
• cargo test --lib (83 passed)
• cargo clippy --all-targets --all-features -- -D warnings

cargo test also runs five existing doctests that fail on current main; all 83 unit tests pass.

Closes #170.

[github-actions]

Thank you for your submission, we really appreciate it. Like many open-source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution. You can sign the CLA by just posting a Pull Request Comment same as the below format.

---

I have read the CLA Document and I hereby sign the CLA

---

_{You can retrigger this bot by commenting recheck in this Pull Request. Posted by the CLA Assistant Lite bot.}