fix: wait for CR finalizers before deleting operators

Addresses Code Rabbit review: the script was deleting operators
immediately after requesting CR deletion, which could interrupt
finalizer processing if the deletion was still in progress.

Changes:
- Add polling loop after CR deletion to wait for finalizers to complete
- Check every 2 seconds for up to 60 seconds that all CRs are gone
- Only proceed to delete Subscriptions/CSVs after CRs are confirmed deleted
- Warn if CRs are still stuck after timeout (indicates stuck finalizers)
- Use wc -l with arithmetic to count CRs (avoids grep -vc || echo issues)
- Properly handle empty output (0 lines = 0 CRs)

This ensures operators have time to properly clean up Deployments,
ReplicaSets, and Pods before we remove the operators themselves,
preventing orphaned resources.

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

Author: jrhyness

.github/hack/cleanup-odh.sh

@@ -127,7 +127,26 @@ for policy_ns in kuadrant-system rh-connectivity-link; do
         kubectl delete kuadrant --all -n "$policy_ns" --ignore-not-found --timeout=60s 2>/dev/null || true
         kubectl delete limitador --all -n "$policy_ns" --ignore-not-found --timeout=60s 2>/dev/null || true
         kubectl delete authorino --all -n "$policy_ns" --ignore-not-found --timeout=60s 2>/dev/null || true
-        echo "   ✅ Workload CRs deleted from $policy_ns"
+
+        # Wait for CRs to be fully deleted (finalizers processed) before removing operators
+        # This prevents orphaned resources if we delete operators while finalizers are still running
+        echo "   Waiting for CR finalizers to complete in $policy_ns..."
+        timeout=60
+        deadline=$((SECONDS + timeout))
+        remaining=1
+        while [[ $SECONDS -lt $deadline ]]; do
+            # Count remaining CRs (wc -l counts all lines, subtract 1 for header if present)
+            count=$(kubectl get kuadrant,limitador,authorino -n "$policy_ns" --ignore-not-found 2>/dev/null | wc -l)
+            remaining=$((count > 0 ? count - 1 : 0))
+            if [[ $remaining -eq 0 ]]; then
+                echo "   ✅ All workload CRs deleted from $policy_ns"
+                break
+            fi
+            sleep 2
+        done
+        if [[ $remaining -gt 0 ]]; then
+            echo "   ⚠️  Warning: $remaining CR(s) still exist in $policy_ns after ${timeout}s (finalizers may be stuck)"
+        fi
     fi
 done