[BUG] CRP deletion leaks Work/AppliedWork and in-cluster resources

[ahmetb]

Describe the bug

A clear and concise description of what the bug is.

Environment

Please provide the following:

• Hub cluster details: 0.16.6
• Member cluster details: 0.16.6

To Reproduce

1. Create a namespace in hub: kubectl create ns foo

2. Create CRP (pickFixed a specific cluster) to propagate a namespace from Hub to Member cluster

   kubectl create -f- <<EOF
   apiVersion: placement.kubernetes-fleet.io/v1beta1
   kind: ClusterResourcePlacement
   metadata:
     name: crp-copy-ns
   spec:
     policy:
       placementType: PickFixed
       clusterNames:
       - member-1
     resourceSelectors:
     - group: ""
       version: v1
       kind: Namespace
       name: foo
     revisionHistoryLimit: 5
   EOF
   

3. When the Namespace foo is applied to member cluster, kubectl edit it, and add a custom example.com/foo finalizer to Namespace's metadata.finalizers.

4. Delete CRP: kubectl delete crp crp-copy-ns.

5. Observe that the Namespace in member cluster shows Terminating but it is also stuck deleting on custom finalizer we added (as expected)

6. Observe the deletion has cascaded to Work (hub API) and AppliedWork (member API) such that there's deletionTimestamp on these objects; but the deletions are stuck (as expected).

   kubectl get work -A -o=custom-columns=NAME:.metadata.name,DELETION-TS:.metadata.deletionTimestamp --context=kind-hub
   NAME               DELETION-TS
   crp-copy-ns-work   2025-10-20T18:21:11Z
   
   kubectl get appliedwork -A --context=kind-member-1 -o=custom-columns=NAME:.metadata.name,DELETION-TS:.metadata.deletionTimestamp
   NAME               DELETION-TS
   crp-copy-ns-work   2025-10-20T18:21:12Z
   

7. However the CRP object is long gone (unexpected):

   kubectl get crp -A --context=kind-hub
   No resources found
   

Expected behavior

ClusterResourcePlacement object should have a finalizer and block its deletion from the API until its Work object disappears.

Screenshots

N/A

Additional context

N/A

[jwtty]

We are aware of the CRP deletion not blocking for work deletion to fully complete and have a work item to fix it.