fix: self-heal dangling bindings

[JamesSprow]

Summary

• fix empty app env Secret churn when Kubernetes returns nil Data for zero-key Secrets
• self-heal dangling binding refs during consumer reconcile, including stale refs that predate fix: converge dangling binding references #417
• keep binding-only Secret cleanup working in the same reconcile after stale bindings are pruned

Testing

• go test ./internal/envstore ./internal/controller

Closes #418
Closes #419