feat: Extract and pass deploymentConfig to bundle renderer

**Summary**

Completes Phase 3 of the [Deployment Configuration RFC](https://docs.google.com/document/d/1bDo3W1asZqjJTgZy7BcVOGtKOEukp0vUi5CO1ac3vwc/edit?usp=sharing).
Extracts `deploymentConfig` from validated ClusterExtension
configuration and passes it to the bundle renderer.

Builds on:
- (PR2454)[#2454]: Config API and JSON schema validation
- (PR2469)[#2469]: Renderer support for applying deployment customizations

This completes the RFC - users can now customize operator deployments via
ClusterExtension.spec.config.inline:

```
config:
  configType: Inline
  inline:
    watchNamespace: "some-namespace"
    deploymentConfig:
      env:
        - name: TEST_ENV
          value: test-value
      nodeSelector:
        kubernetes.io/os: linux
```

Author: anik120

internal/operator-controller/applier/provider.go

@@ -84,6 +84,15 @@ func (r *RegistryV1ManifestProvider) Get(bundleFS fs.FS, ext *ocv1.ClusterExtens
 		if watchNS := bundleConfig.GetWatchNamespace(); watchNS != nil {
 			opts = append(opts, render.WithTargetNamespaces(*watchNS))
 		}
+
+		// Extract and convert deploymentConfig if present
+		if deploymentConfigMap := bundleConfig.GetDeploymentConfig(); deploymentConfigMap != nil {
+			deploymentConfig, err := convertToDeploymentConfig(deploymentConfigMap)
+			if err != nil {
+				return nil, errorutil.NewTerminalError(ocv1.ReasonInvalidConfiguration, fmt.Errorf("invalid deploymentConfig: %w", err))
+			}
+			opts = append(opts, render.WithDeploymentConfig(deploymentConfig))
+		}
 	}
 	return r.BundleRenderer.Render(rv1, ext.Spec.Namespace, opts...)
 }
@@ -149,6 +158,29 @@ func extensionConfigBytes(ext *ocv1.ClusterExtension) []byte {
 	return nil
 }
 
+// convertToDeploymentConfig converts a map[string]any (from validated bundle config)
+// to a *config.DeploymentConfig struct that can be passed to the renderer.
+// Returns nil if the map is nil or empty.
+func convertToDeploymentConfig(deploymentConfigMap map[string]any) (*config.DeploymentConfig, error) {
+	if deploymentConfigMap == nil || len(deploymentConfigMap) == 0 {
+		return nil, nil
+	}
+
+	// Marshal the map to JSON
+	data, err := json.Marshal(deploymentConfigMap)
+	if err != nil {
+		return nil, fmt.Errorf("failed to marshal deploymentConfig: %w", err)
+	}
+
+	// Unmarshal into the DeploymentConfig struct
+	var deploymentConfig config.DeploymentConfig
+	if err := json.Unmarshal(data, &deploymentConfig); err != nil {
+		return nil, fmt.Errorf("failed to unmarshal deploymentConfig: %w", err)
+	}
+
+	return &deploymentConfig, nil
+}
+
 func getBundleAnnotations(bundleFS fs.FS) (map[string]string, error) {
 	// The need to get the underlying bundle in order to extract its annotations
 	// will go away once we have a bundle interface that can surface the annotations independently of the

internal/operator-controller/applier/provider_test.go

@@ -444,6 +444,153 @@ func Test_RegistryV1ManifestProvider_SingleOwnNamespaceSupport(t *testing.T) {
 	})
 }
 
+func Test_RegistryV1ManifestProvider_DeploymentConfig(t *testing.T) {
+	t.Run("passes deploymentConfig to renderer when provided in configuration", func(t *testing.T) {
+		expectedEnvVars := []corev1.EnvVar{
+			{Name: "TEST_ENV", Value: "test-value"},
+		}
+		provider := applier.RegistryV1ManifestProvider{
+			BundleRenderer: render.BundleRenderer{
+				ResourceGenerators: []render.ResourceGenerator{
+					func(rv1 *bundle.RegistryV1, opts render.Options) ([]client.Object, error) {
+						t.Log("ensure deploymentConfig is passed to renderer")
+						require.NotNil(t, opts.DeploymentConfig)
+						require.Equal(t, expectedEnvVars, opts.DeploymentConfig.Env)
+						return nil, nil
+					},
+				},
+			},
+			IsSingleOwnNamespaceEnabled: true,
+		}
+
+		bundleFS := bundlefs.Builder().WithPackageName("test").
+			WithCSV(clusterserviceversion.Builder().WithInstallModeSupportFor(v1alpha1.InstallModeTypeAllNamespaces).Build()).Build()
+
+		_, err := provider.Get(bundleFS, &ocv1.ClusterExtension{
+			Spec: ocv1.ClusterExtensionSpec{
+				Namespace: "install-namespace",
+				Config: &ocv1.ClusterExtensionConfig{
+					ConfigType: ocv1.ClusterExtensionConfigTypeInline,
+					Inline: &apiextensionsv1.JSON{
+						Raw: []byte(`{"deploymentConfig": {"env": [{"name": "TEST_ENV", "value": "test-value"}]}}`),
+					},
+				},
+			},
+		})
+		require.NoError(t, err)
+	})
+
+	t.Run("does not pass deploymentConfig to renderer when not provided in configuration", func(t *testing.T) {
+		provider := applier.RegistryV1ManifestProvider{
+			BundleRenderer: render.BundleRenderer{
+				ResourceGenerators: []render.ResourceGenerator{
+					func(rv1 *bundle.RegistryV1, opts render.Options) ([]client.Object, error) {
+						t.Log("ensure deploymentConfig is nil when not provided")
+						require.Nil(t, opts.DeploymentConfig)
+						return nil, nil
+					},
+				},
+			},
+			IsSingleOwnNamespaceEnabled: true,
+		}
+
+		bundleFS := bundlefs.Builder().WithPackageName("test").
+			WithCSV(clusterserviceversion.Builder().WithInstallModeSupportFor(v1alpha1.InstallModeTypeAllNamespaces).Build()).Build()
+
+		_, err := provider.Get(bundleFS, &ocv1.ClusterExtension{
+			Spec: ocv1.ClusterExtensionSpec{
+				Namespace: "install-namespace",
+				// No config provided
+			},
+		})
+		require.NoError(t, err)
+	})
+
+	t.Run("passes deploymentConfig with multiple fields to renderer", func(t *testing.T) {
+		expectedNodeSelector := map[string]string{"kubernetes.io/os": "linux"}
+		expectedTolerations := []corev1.Toleration{
+			{Key: "key1", Operator: "Equal", Value: "value1", Effect: "NoSchedule"},
+		}
+		provider := applier.RegistryV1ManifestProvider{
+			BundleRenderer: render.BundleRenderer{
+				ResourceGenerators: []render.ResourceGenerator{
+					func(rv1 *bundle.RegistryV1, opts render.Options) ([]client.Object, error) {
+						t.Log("ensure all deploymentConfig fields are passed to renderer")
+						require.NotNil(t, opts.DeploymentConfig)
+						require.Equal(t, expectedNodeSelector, opts.DeploymentConfig.NodeSelector)
+						require.Equal(t, expectedTolerations, opts.DeploymentConfig.Tolerations)
+						return nil, nil
+					},
+				},
+			},
+			IsSingleOwnNamespaceEnabled: true,
+		}
+
+		bundleFS := bundlefs.Builder().WithPackageName("test").
+			WithCSV(clusterserviceversion.Builder().WithInstallModeSupportFor(v1alpha1.InstallModeTypeAllNamespaces).Build()).Build()
+
+		_, err := provider.Get(bundleFS, &ocv1.ClusterExtension{
+			Spec: ocv1.ClusterExtensionSpec{
+				Namespace: "install-namespace",
+				Config: &ocv1.ClusterExtensionConfig{
+					ConfigType: ocv1.ClusterExtensionConfigTypeInline,
+					Inline: &apiextensionsv1.JSON{
+						Raw: []byte(`{
+							"deploymentConfig": {
+								"nodeSelector": {"kubernetes.io/os": "linux"},
+								"tolerations": [{"key": "key1", "operator": "Equal", "value": "value1", "effect": "NoSchedule"}]
+							}
+						}`),
+					},
+				},
+			},
+		})
+		require.NoError(t, err)
+	})
+
+	t.Run("passes both watchNamespace and deploymentConfig when both provided", func(t *testing.T) {
+		expectedWatchNamespace := "some-namespace"
+		expectedEnvVars := []corev1.EnvVar{
+			{Name: "TEST_ENV", Value: "test-value"},
+		}
+		provider := applier.RegistryV1ManifestProvider{
+			BundleRenderer: render.BundleRenderer{
+				ResourceGenerators: []render.ResourceGenerator{
+					func(rv1 *bundle.RegistryV1, opts render.Options) ([]client.Object, error) {
+						t.Log("ensure both watchNamespace and deploymentConfig are passed to renderer")
+						require.Equal(t, []string{expectedWatchNamespace}, opts.TargetNamespaces)
+						require.NotNil(t, opts.DeploymentConfig)
+						require.Equal(t, expectedEnvVars, opts.DeploymentConfig.Env)
+						return nil, nil
+					},
+				},
+			},
+			IsSingleOwnNamespaceEnabled: true,
+		}
+
+		bundleFS := bundlefs.Builder().WithPackageName("test").
+			WithCSV(clusterserviceversion.Builder().WithInstallModeSupportFor(v1alpha1.InstallModeTypeSingleNamespace).Build()).Build()
+
+		_, err := provider.Get(bundleFS, &ocv1.ClusterExtension{
+			Spec: ocv1.ClusterExtensionSpec{
+				Namespace: "install-namespace",
+				Config: &ocv1.ClusterExtensionConfig{
+					ConfigType: ocv1.ClusterExtensionConfigTypeInline,
+					Inline: &apiextensionsv1.JSON{
+						Raw: []byte(`{
+							"watchNamespace": "some-namespace",
+							"deploymentConfig": {
+								"env": [{"name": "TEST_ENV", "value": "test-value"}]
+							}
+						}`),
+					},
+				},
+			},
+		})
+		require.NoError(t, err)
+	})
+}
+
 func Test_RegistryV1HelmChartProvider_Integration(t *testing.T) {
 	t.Run("surfaces bundle source errors", func(t *testing.T) {
 		provider := applier.RegistryV1HelmChartProvider{