Approving — the fix is correct and the core scenario is covered (first CRD update hits a conflict → retried → succeeds, no crash-loop).

Test coverage note (non-blocking — fine as a follow-up PR, not a blocker for this backport):

1. The already-converged skip path isn't exercised. The GET stub returns the same un-updated CRD on every call, so apiequality.Semantic.DeepEqual(current, desired) is always false and the return nil early-return (skip the update when a peer replica already added the version) never runs — even though the test name says "…AndConverges". A case where the re-GET returns the already-updated CRD (and asserts a single update) would cover the realistic race-loser path, plus the re-GET→fresh-ResourceVersion retry mechanic.

2. Error/edge branches of crdUpdateWithNewVersion are untested: version-not-found (newVersion == nil), GET error inside the retry loop, and non-conflict / exhausted-retry terminal error.

Both are missing-coverage items only — nothing is broken. They can land in a follow-up so this PR isn't held up.