fix: prevent panic on invalid regex in reload annotation

ShouldReload compiled each comma-separated value of a named reload
annotation (e.g. secret.reloader.stakater.com/reload) with
regexp.MustCompile, which panics on an invalid pattern. The value comes
straight from a user-set annotation on a watched workload, and the queue
worker has no recover(), so a single malformed annotation (e.g.
"app-config[") on any workload in any watched namespace crashes Reloader
and stops reloads cluster-wide.

Use regexp.Compile and, on error, log and skip that pattern instead of
panicking.

pkg/common/common_test.go

@@ -222,3 +222,27 @@ func TestShouldReload_IssueRBACPermissionFixed(t *testing.T) {
 		})
 	}
 }
+
+// A malformed regex in a named reload annotation must not panic the operator.
+// Regression test: previously regexp.MustCompile("^"+value+"$") panicked on an
+// invalid pattern, crashing Reloader cluster-wide (no recover on the worker).
+func TestShouldReload_InvalidRegexAnnotation_DoesNotPanic(t *testing.T) {
+	config := Config{
+		ResourceName: "app-config",
+		Annotation:   "secret.reloader.stakater.com/reload",
+	}
+	annotations := Map{
+		// unbalanced bracket => invalid regex
+		"secret.reloader.stakater.com/reload": "app-config[",
+	}
+	opts := &ReloaderOptions{
+		ReloaderAutoAnnotation: "reloader.stakater.com/auto",
+	}
+
+	// Before the fix this panicked inside ShouldReload.
+	result := ShouldReload(config, "Deployment", annotations, Map{}, opts)
+
+	if result.ShouldReload {
+		t.Errorf("Expected ShouldReload=false for an invalid regex pattern, got=%v", result.ShouldReload)
+	}
+}