Story 5.4c — Resume execute workflow from PendingInfraUpgrade after daemon restart

**Epic:** #502 — Network Upgrade Workflow (Execute Phase)

(Split from #540, part 3 of 3.) Resume the execute-phase workflow after the daemon is restarted
mid-infra-upgrade by the cluster rebuild.

**Acceptance criteria:**
- Teach `listAndSeed` (`upgrade_monitor.go`) to dispatch/resume CRs at `PendingInfraUpgrade`, not only `ReadyForProvisionerDaemon` — otherwise a restart orphans the in-progress CR.
- On resume, retry all Kubernetes API connections with exponential backoff until the operator has redeployed RBAC (service accounts, roles, role bindings) before continuing.
- Idempotently continue the workflow from where it left off (infra already done → proceed to config CR creation), without re-running the cluster rebuild.

**Blocked on:** epic #500.
**Depends on:** #708 (5.4b cluster rebuild).