Fix: crane export does not write clusterroles.yaml to failures/ directory

[midays]

Summary

When running crane export as a namespace-admin, the export correctly attempts to
collect ClusterRoles but filters them all out (0 of N matched). However, clusterroles.yaml
is not written to the failures/ directory, even though a generic
"Failed to collect cluster-scoped resources" error is logged.

Expected behavior

failures/<namespace>/clusterroles.yaml should be written whenever crane attempts
to export ClusterRoles and fails or finds 0 matching resources, so callers can
distinguish between "not attempted" and "attempted but nothing matched/accessible".

Actual behavior

The failures/ directory contains entries for other resource types but is missing
clusterroles.yaml. The log shows:

• "Filtering for kind ClusterRole (299 found)"
• "After filtering 0 remained out of 299"
• "Failed to collect cluster-scoped resources; check the failures/ directory for details"

But no clusterroles.yaml is produced in failures/.

Impact

MTA-853 (split apply test) fails at the verification step because it relies on
clusterroles.yaml being present in failures/ to confirm that the namespace-admin
export correctly could not export cluster-scoped resources.

Repo

migtools/crane

[github-actions]

This issue is currently awaiting triage.
If contributors determine this is a relevant issue, they will accept it by applying the triage/accepted label and provide further guidance.
The triage/accepted label can be added by org members by writing /triage accepted in a comment.

[stillalearner]

This is probably the cluster permission difference on OCP vs minikube

Failures are only reported when unable to list the resources, and not on 0 resources.

[istein1]

@midays ,
Further to @stillalearner's comment, seems Test MTA-853 should either:

1. Assert differently depending on the platform (OCP vs minikube), or
2. Not rely on failures/clusterroles.yaml existing as proof that cluster-scoped export was denied

[RanWurmbrand]

@istein1 @midays @stillalearner

right after the the assertion for checking up that the resources ended up on the failure directory, the test checks that the _cluster directory is empty.
so i think it is safe to remove this assertion, and just keep the one that assert the _cluster directory is empty.

[stillalearner]

@RanWurmbrand can you please confirm before that, why exactly this difference in behaviour on OCP vs minikube, before we change the test case.