Upgrade Dry-Run Check

Current gap:

The existing --dry-run lists real CRs and calls their reconcilers with writes disabled. List and reconcile errors are logged, but the command can still print success and return exit code 0. A blocked cached read has no per-object timeout.

Change:

Update the existing --dry-run to:

• check that required CRDs and Kubernetes APIs exist
• run as the Operator ServiceAccount and execute the same list and reconcile paths as the Operator
• apply a timeout to each list and reconcile operation
• print the controller, object, phase, Kubernetes reason, and original error
• exit with a non-zero code on a real failure or timeout
• keep create, update, patch, and delete disabled.

If a check waits for a write that dry-run suppressed, report planned_change_not_applied and do not count it as a failure. The command must not change RBAC or other resources.

Done when:

The stale v0.73 ClusterRole fails in under one minute and names both missing v0.74 permissions. The correct v0.74 package passes.

Product result:

A bad upgrade fails with a clear reason before the running Operator is changed.