fix(approve-installplan): cache InstallPlan query and retry on version mismatch

[oliashish]

• Fetch InstallPlans once per iteration and run all jq filters against that
  cached snapshot: fewer API calls and one consistent view per iteration.
• Don't exit on a newer-than-pinned plan (OLM catalog resolution is eventually
  consistent); warn and retry, failing only once retries are exhausted. The
  version gate is preserved: a wrong-version plan is never approved.

Tested them locally by

• Dry ran the actual approval logic against the live operators but blocked the write step, and confirmed it correctly refuses to approve a version that doesn't match the pinned one.
• Also tested in a throwaway namespace by setting t up a fake operator waiting for approval, then let the real script run for real and it found the right install plan, approved it, and the operator installed successfully end to end.

Jira: OSPRH-33123, OSPRH-33124

Co-Authored-By: Claude Opus 4.8 noreply@anthropic.com

[cjeanner]

Looks OK. There were some testing on the side, since we don't have CI capabilities to test that specific kind of changes. Reports were green.