stream: guard delta subscriptions against nil returned resource maps

[immanuwell]

Description

Small bug fix in delta subscription state.

SetReturnedResources(nil) leaves returnedResources nil. If the subscription is wildcard and later unsubscribes a named resource, UpdateResourceSubscriptions writes into that map and panics with assignment to entry in nil map.

This patch normalizes nil to an empty map, so that path stays safe. Pretty small footgun, easy fix.

#

N/A

Type of change

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to not work as expected)
• This change requires a documentation update

How has this been tested?

Repro before fix:

sub := stream.NewDeltaSubscription([]string{"*", "resource"}, nil, map[string]string{"resource": "version"}, false)
sub.SetReturnedResources(nil)
sub.UpdateResourceSubscriptions(nil, []string{"resource"})

Before this patch, that panics. After it, no panic and resource is tracked as removed, as expected.

• go test ./...
• go test -race ./pkg/server/stream/v3 ./pkg/cache/v3 ./pkg/server/v3

Test Configuration:

• Go Toolchain: go1.25.0

Checklist:

• I have made corresponding changes to the changelog
• My changes generate no new warnings
• Any dependent changes have been merged and published in downstream modules
• I've added sufficient test coverage for my change. If not, please explain why.