✨ Summary

Adds an optional LABEL_SELECTOR environment variable. When set, the operator only reconciles OnePasswordItem resources whose labels match the selector; unset (the default) reconciles all items, so behavior is unchanged for existing deployments.

This enables running multiple operators that watch the same namespaces where each 1Password Connect token / service account only has access to its own vaults. Without it, every operator reconciles every OnePasswordItem cluster-wide and returns 403: token does not have access to vault on items it doesn't own, racing to overwrite each other's OnePasswordItem status. Giving each operator a distinct label selector makes each item owned by exactly one operator.

Implementation: a predicate.LabelSelectorPredicate on the OnePasswordItem controller's SetupWithManager (scoped to that controller only — the Deployment auto-restart watcher is untouched). The selector is parsed once from LABEL_SELECTOR via metav1.ParseToLabelSelector; an invalid value fails fast at startup. No CRD/API change — it filters on existing metadata.labels.

Example:

```yaml

operator Deployment env

• name: LABEL_SELECTOR
  value: "operator-owner=team-a"

apiVersion: onepassword.com/v1
kind: OnePasswordItem
metadata:
name: example-secret
labels:
operator-owner: team-a # reconciled by the operator above; others ignore it
spec:
itemPath: "vaults//items/"
```

🔗 Resolves:

N/A (no existing issue found)

✅ Checklist

• 🖊️ Commits are signed
• 🧪 Tests added/updated:
  • 🔹 Unit — label-selector predicate matching/non-matching/unlabeled (internal/controller/onepassworditem_predicate_test.go)
  • 🔸 Integration
  • 🌐 E2E (Connect)
  • 🔑 E2E (Service Account)
• 📚 Docs updated — USAGEGUIDE.md (both env-var lists + a new "Filtering which OnePasswordItems an operator reconciles" section), config/manager/manager.yaml, test/e2e/manifests/manager.yaml, CHANGELOG.md

🕵️ Review Notes & ⚠️ Risks

• Fully backward compatible: no LABEL_SELECTOR set ⇒ nil selector ⇒ no predicate ⇒ all items reconciled (today's behavior).
• Scoped to the OnePasswordItem controller; the Deployment/secret-update paths are unchanged.
• make test and make lint pass; no generated-file drift.
• Note: the periodic secret-update poller still refreshes secrets by annotation and is not label-scoped; it updates Secret data (not OnePasswordItem status), so it does not cause the status flapping this addresses. Could be a follow-up if desired.
• The {#PR} placeholder in the CHANGELOG.md "Latest" entry should be replaced with this PR number.