Please address the comments from this code review:

## Individual Comments

### Comment 1
<location path="sensor/admission-control/manager/manager_impl.go" line_range="97" />
<code_context>
 	imageNameCacheSize = 8192
 )

+// imageGenTracker tracks per-key generation counters to prevent stale in-flight
+// fetches from re-caching data after an invalidation or full purge.
+type imageGenTracker struct {
</code_context>
<issue_to_address>
**issue (complexity):** Consider replacing the per-key imageGenTracker with a single atomic global generation counter to simplify stale-fetch protection logic while preserving behavior.

You can keep the stale‑fetch protection while substantially simplifying the tracking logic.

### 1. Collapse `imageGenTracker` into a single global generation

Given the current use (invalidate on targeted keys + purge on cacheVersion change), a single monotonic cache generation is enough to prevent stale in‑flight writes, without per‑key tracking and without duplicating `cacheVersion`.

You can remove `imageGenTracker` entirely and add an atomic generation field to `manager`:

```go
type manager struct {
    // ...
    imageCacheGen atomic.Uint64 // global generation for all image cache state
    // ...
}
```

Increment it on any event that invalidates cache correctness (cacheVersion change or targeted invalidation):

```go
func (m *manager) processImageCacheInvalidation(inv *sensor.AdmCtrlImageCacheInvalidation) {
    s := m.currentState()
    flatten := s != nil && s.GetFlattenImageData()

    // bump global generation once per invalidation batch
    m.imageCacheGen.Add(1)

    invalidated := 0
    for _, key := range inv.GetImageKeys() {
        cacheKey := key.GetImageId()
        if flatten && key.GetImageIdV2() != "" {
            cacheKey = key.GetImageIdV2()
        }
        fullName := key.GetImageFullName()

        if cacheKey != "" {
            m.imageCache.Remove(cacheKey)
            m.imageFetchGroup.Forget(cacheKey)
            invalidated++
        }
        if fullName != "" {
            m.imageNameToImageCacheKey.Remove(fullName)
            m.imageFetchGroup.Forget(fullName)
        }
    }

    log.Infof("Targeted image cache invalidation: invalidated %d entries", invalidated)
}
```

On settings changes, use the same generation instead of separate `cacheVersion` in the tracker:

```go
if newSettings.GetCacheVersion() != m.cacheVersion {
    log.Infof("CacheVersion changed (%s -> %s): purging image cache",
        m.cacheVersion, newSettings.GetCacheVersion())

    m.imageCache.Purge()
    m.imageNameToImageCacheKey.Purge()
    m.imageCacheGen.Add(1) // invalidate all in-flight fetches

    m.cacheVersion = newSettings.GetCacheVersion()
}
```

### 2. Simplify the fetch path API

Instead of `Snapshot` + `Changed` with `gen` and `cacheVersion`, expose a minimal “snapshot + stale check” around the global generation:

At fetch start:

```go
startGen := m.imageCacheGen.Load()
// ... perform remote fetch ...
if startGen != m.imageCacheGen.Load() {
    // stale: cache was invalidated during fetch; do not write result
    return result // or just skip storing
}
// safe to store in caches
```

You can wrap this in a helper if you want to keep call sites clean:

```go
type cacheGenSnapshot uint64

func (m *manager) snapshotCacheGen() cacheGenSnapshot {
    return cacheGenSnapshot(m.imageCacheGen.Load())
}

func (m *manager) isCacheSnapshotStale(s cacheGenSnapshot) bool {
    return uint64(s) != m.imageCacheGen.Load()
}
```

Usage:

```go
snap := m.snapshotCacheGen()
// ... fetch ...
if m.isCacheSnapshotStale(snap) {
    return img // but do not update cache
}
// update cache
```

This preserves the “don’t re‑cache after invalidation/purge” behavior while:

- Removing the separate `imageGenTracker` type, mutex, and per‑key map.
- Avoiding the dual `cacheVersion` + per‑key generation tracking.
- Eliminating `Get`/`Clear` methods used only for tests; tests instead assert behavior via the public fetch/invalidation API and `imageCacheGen` if needed.
</issue_to_address>