SDP 26.7.0 changed how the operator Helm charts reference registries, which
broke OLM manifest generation in three ways:

* Operator images moved under the "sdp" path on quay.io, so the digest lookup
  no longer resolved. Introduce QUAY_REPO for the repository prefix. Also add
  the trailing slash to the tag API URL, which quay now 308-redirects to.

* The charts no longer define image.repository in values.yaml; it comes from a
  per-registry overlay instead. Without one the chart fails to render, and the
  new IMAGE_REPOSITORY env var (which tells the operator where to pull product
  images from) has no value. Pass values/quay.io.yaml so bundles reference
  quay.io throughout.

* The product cluster role is now empty unless the OpenShift API is advertised,
  because its only remaining rule is the securitycontextconstraints grant.
  Pass --api-versions security.openshift.io/v1 and drop the Python patching of
  that rule. The charts gate it themselves, and some operators gate more than
  one cluster role this way (spark has three, opa has two) which the single-role
  patch silently missed.

Also correct the module docstring, which documented a nonexistent --output-dir,
and the secret/listener rejection message, which pointed at a deleted script.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>