Function validate_access_modes 

pub fn validate_access_modes(
    field: &str,
    modes: &[PvcAccessMode],
) -> Vec<ValidationError>

Validate a PVC access-modes list wherever one appears (spec.staging.accessModes, restore.target.pvc.accessModes). Three rules, one place, both callers (webhook at admission, controller defensively):

• every entry must be canonical — an PvcAccessMode::Unknown value is either a legacy stored string from before schema enforcement or a typo, and no PVC could ever be provisioned from it;
• no duplicates;
• ReadWriteOncePod must be the sole mode — the apiserver rejects the combination at PVC-create time, so catching it here fails at admission with the reason instead of wedging the first run in a create-retry loop.

field names the exact path for the message. Accumulates so every bad entry is reported in one apply.