Model represents a stored or remotely-sourced AI model artifact within a namespace.
It carries descriptive metadata about the model (family, type, precision,
quantization, parameter count, etc.) and acts as the central identity that
ModelClass, LoRAAdapter, and FineTuningJob reference.

rackai.rackspace.com/uri-hash label with the following rules:

• Controller service account (e.g. rackai-controller-manager) MAY add,
  update, or remove the label. The controller stamps it when cache=true is
  first reconciled and removes it during the cache=true→false cleanup path.
• All other principals (end-users, CI, kubectl) MUST NOT modify or delete
  the label once it has been stamped. Reject the request with a clear
  message explaining that the label is managed by the controller.

A webhook is necessary here because CEL transition rules apply to ALL
mutations regardless of who makes them, so CEL cannot distinguish the
controller from a user and would block legitimate controller cleanup.