[Al-assad]

Service comparison trusted a cached desired-state hash, so changes to the live selector, ports, type, or managed metadata could be ignored. It also omitted explicitly configured loadBalancerIP and other fields constructed by the operator.

Compare normalized live managed fields instead. Retain API defaults, allocated ClusterIP/NodePort values, unspecified cloud addresses, and externally added metadata. Patch from the current Service with optimistic locking so false/empty managed values are corrected without replacing allocated fields. Hash annotations remain informational and no longer prove equality.

Validation:

• Reproduced drift and defaulting failures before the fix.
• Fourteen cached-hash drift cases cover DCR/DDC hash keys and selector, port, type, explicit loadBalancerIP, session affinity, publishNotReadyAddresses, and labels.
• Real Kubernetes 1.31 API test verifies drift correction, explicit true-to-false repair, ClusterIP/NodePort preservation, and no write on repeated reconcile.
• All controller and common utility package tests passed.

QA validation passed with selectdb/doris-operator:26.1.0-rc06: an existing DDC FE Service retained its old hash while selector, target port, affinity, and publishNotReadyAddresses were changed. Reconciliation repaired all fields in 15.936s, preserving Service UID, ClusterIP, external annotations, workload Pod UIDs, and CR generation. This PR preserves unspecified LoadBalancerIP rather than taking ownership of a cloud-assigned address. Resource ownership protection is submitted separately in #542 and should land before broad drift reconciliation.