Two copies of the job-step lookup on OperationPlan

The problem

Two functions walk an OperationPlan's steps to find its single job step:

• jobStepOf (cmd/ob/commands.go:900-910) returns the step, for the approval
  summary and the typed token.
• jobNameOfOperation (internal/onebox/expiry_errors.go:67-76) returns just
  the name, for expiry messages.

Same loop, same guarantee behind it — JobPlan.validateContent
(internal/onebox/job_plan.go:97-104) ensures exactly one StepJob whose
Component matches Artifact.Job. Two copies means a future change to what
"the job step" is has two places to land, and the CLI copy exists only because
the onebox one is unexported and returns the wrong shape.

Proposed change

Export one accessor on OperationPlan — JobStep() (OperationStep, bool) —
next to the type it belongs to, and have both callers use it.
jobNameOfOperation becomes a thin wrapper or disappears.

Current workaround

None needed; both copies are correct today. This is about keeping them that
way.

Scope and safety

Pure refactor. No behaviour change, no schema change, no new command surface.

Found while auditing #171.

Start with the OperationPlan type and JobPlan.validateContent in internal/onebox/job_plan.go to understand the single-job-step guarantee. Then inspect the two callers in cmd/ob/commands.go and internal/onebox/expiry_errors.go. Done means both callers use one exported OperationPlan accessor, with no behavior or schema changes.