feat(oc-runner): fail fast with a clear message when the runner IP is blocked from the OpenShift API #49

Problem

Firewall rules intermittently block some GitHub-hosted runner IPs from the OpenShift API. Retries don't help because they reuse the same runner and IP, so jobs burn minutes and then fail with unclear oc errors.

Plan

Add a pre-flight reachability check to oc-runner, before oc login and before any caller commands:

• Unauthenticated curl to the API's /version with a short timeout (about 10s). No token, no oc.
• Timeout or connection refused: the runner can't reach the API. Also probe the silver router (console.apps.silver…:443). If the router answers, report "cluster is up, this runner's IP (x.x.x.x) is blocked from the OpenShift API; re-run the job to get a different runner". Otherwise report the cluster as unreachable. Fail immediately.
• Any HTTP response (including 401/403): the network is fine; continue. Later oc failures are reported as normal command failures.
• Drop oc-runner's retries to at most one, for genuine blips.
• Log the runner egress IP on failure so the firewall team has evidence.

Not doing

No in-cluster relay or CONNECT proxy (old drafts bcgov/action-oc-runner#86, #87, #88 are closed). The scheduled probe from #55 (merged) keeps collecting reachability data alongside this.

Done when

• The check is in oc-runner, existing callers need no changes, and the README explains the failure message.
• CI passes.