overwrite: false swallows every oc create error, not only AlreadyExists

## Problem

`overwrite: false` is documented as create-if-missing (`oc create`) so `AlreadyExists` is non-fatal. The implementation turns **every** create failure into a successful step.

```bash
(set +o pipefail; oc create -f - 2>&1 <<< "${TEMPLATE}" | sed 's/.*: //')
```

`set +o pipefail` plus piping through `sed` means the step exit status is `sed`'s, not `oc create`'s. Forbidden, invalid YAML, quota, and missing SCCs all look like success. Callers then start dependent jobs (e.g. a database StatefulSet) while the Secret or NetworkPolicy was never created.

This is still on `main` and in v4.2.1 (`27a85b7`). The subshell/`pipefail` split landed in #112 to stop `overwrite: true` from ignoring apply errors; the create path still ignores all of them. The comment says "Allow AlreadyExists errors and expected failures" — that is wider than AlreadyExists.

## Expected

- Object missing → `oc create` succeeds.
- Object already exists → success (or a clear, ignored AlreadyExists).
- Any other `oc create` error → step fails.

## Suggestion

Keep `pipefail` on. Ignore only AlreadyExists (e.g. check `oc create` status and stdout/stderr for `AlreadyExists`, or create object-by-object). Do not `sed` the error away before the status is checked.

## Not a workaround in callers

Consumers cannot fix this without duplicating create/get logic. Quickstart is moving init Secret/NetworkPolicies to `overwrite: false` so Postgres is not restamped after first boot (`bcgov/quickstart-openshift#2834`). A missing Secret would then fail later in Flyway/backend, not at init.