Warn at startup when installed CRDs are stale or missing

The operator strict-decodes CR specs, so when the in-cluster CRDs lag the
running operator (e.g. CRDs pinned to v0.1.0 while the operator ran v0.3.0),
new spec fields fail to decode with no operator-side signal. This adds an
advisory startup check so the mismatch is visible in the operator logs.

- Add CheckCRDVersions: GET each owned CRD and verify it carries a
  version-sentinel spec field, logging a distinct WARNING per problem
  (missing CRD vs. present-but-stale schema); advisory only, never exits.
- Keep the sentinel list (buckets/managePolicy, objectstoreusers/
  retainOnDelete, bucketaccesses/rawStatements) in one place.
- Wire the check into operator startup after the manager config is available.
- Add apiextensions customresourcedefinitions get;list RBAC marker and
  regenerate config/rbac/role.yaml.
- Promote k8s.io/apiextensions-apiserver to a direct dependency.

Claude-Session: https://claude.ai/code/session_016CEncETbf8cvy1PhsHfFHM

cmd/operator/main.go

@@ -73,6 +73,13 @@ func main() {
 		os.Exit(1)
 	}
 
+	// Advisory only: warn (never exit) if the installed CRDs are missing or
+	// predate this operator's schema, which otherwise surfaces only as opaque
+	// strict-decode failures during reconcile.
+	crdCtx, crdCancel := context.WithTimeout(context.Background(), 15*time.Second)
+	controller.CheckCRDVersions(crdCtx, mgr.GetConfig())
+	crdCancel()
+
 	if err := mgr.AddHealthzCheck("healthz", healthz.Ping); err != nil {
 		logger.Error(err, "unable to set up health check")
 		os.Exit(1)