patch volumeattachments

Spec is immutable after creation, and a status write aimed at the main resource is silently dropped.

The request returns success and changes nothing.

What remains reachable is metadata such as labels and annotations, so the spurious-detach path needs volumeattachments/status instead of this grant.