feat(#320): add maintenance automation script

[fullsend-ai-coder]

What type of PR is this?

feature

What this PR does / why we need it?

Adds a maintenance automation script (hack/maintenance-update.py) to streamline per-OCP-release maintenance for ocm-agent-operator. The script is ported from managed-upgrade-operator (SREP-915) and adapted for this operator's dependency structure.

The script automates:

• Updating version-pinned dependencies (e.g., github.com/openshift/api) to a release branch
• Updating controller-runtime to the version matching the target OCP release
• Updating latest-tracking dependencies (e.g., github.com/openshift/osde2e-common)
• Running go mod tidy and boilerplate/_lib/container-make validation
• Updating boilerplate via make boilerplate-update
• Interactive git staging and committing of changes

Default dependency lists are tailored to ocm-agent-operator. The controller-runtime version map covers OCP releases 4.17 through 4.20.

Documentation in docs/development.md is updated with usage instructions for the maintenance workflow.

Which Jira/Github issue(s) this PR fixes?

Fixes #320
Jira: ROSAENG-1452

Special notes for your reviewer:

• The script is a direct port from managed-upgrade-operator's maintenance-update.py, adapted with ocm-agent-operator-specific defaults
• Per the issue's non-goal, this does not update deps specific to an OpenShift release — it only provides the tooling to do so
• The controller-runtime version mapping may need extending as new OCP releases are supported
• No Go code changes — this is a Python script addition and documentation update only

Pre-checks (if applicable):

• Tested latest changes against a cluster
• Ran make generate command locally to validate code changes
• Included documentation changes with PR

---

Closes #320

Post-script verification

• Branch is not main/master (agent/320-maintenance-automation)
• Secret scan passed (gitleaks — 7f9e6417953d949242cdfc37c83dc0d25f5b5f7a..HEAD)
• PR body secret scan passed (gitleaks — no-git)
• Pre-commit hooks passed (authoritative run on runner)
• Tests ran inside sandbox

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: fullsend-ai-coder[bot]
Once this PR has been reviewed and has the lgtm label, please assign bmeng for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[openshift-ci]

Hi @fullsend-ai-coder[bot]. Thanks for your PR.

I'm waiting for a openshift member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work.

Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.