fix(cleanup): restore the name-based sweep for pre-ADR-020 agent leftovers

An earlier commit on this branch replaced four name-based deletes (job, sa,
role, rolebinding named "aicr" in gpu-operator) with a label selector on
app.kubernetes.io/name=aicr,app.kubernetes.io/component=snapshot-agent.
Pre-branch objects never carried those labels: origin/main's
ensureServiceAccount, ensureRole and ensureRoleBinding set no Labels at all,
and its Job carried only app.kubernetes.io/name. So the block, still commented
"Legacy on-cluster agent leftovers from the older deployment pattern", swept
only current-run objects and no legacy one.

Both sweeps are now present. They cannot collide: a run-scoped name is always
"aicr-<run-id>", never the bare "aicr". The comment describes what the code
actually does.

The aicr-node-reader ClusterRole/ClusterRoleBinding lines are deliberately
untouched — whether to add a name-based delete for the legacy pair is a
separate decision.

Refs: ADR-020
Signed-off-by: Alex Yuskauskas <ayuskauskas@nvidia.com>

Author: ayuskauskas

tools/cleanup

@@ -347,14 +347,28 @@ if ! $DRY_RUN; then
         | xargs -r kubectl delete --ignore-not-found || true
 fi
 kc delete ns aicr-validation --ignore-not-found --wait=false
-# Legacy on-cluster agent leftovers from the older deployment pattern.
-# Run-scoped agent resources (Job/SA/Role/RoleBinding) are named
-# "aicr-<run-id>", so a fixed-name delete never matches current runs; select
-# by the label every one of them carries instead.
+# On-cluster snapshot-agent leftovers, current and legacy. Both sweeps are
+# needed and neither subsumes the other:
+#
+#   - Current (ADR-020) runs name their Job/SA/Role/RoleBinding
+#     "aicr-<run-id>", so no fixed-name delete matches them; they are found by
+#     the label set every one of them carries.
+#   - Pre-ADR-020 runs used the fixed name "aicr" and carried none of those
+#     labels — the Job had only app.kubernetes.io/name, and the SA, Role and
+#     RoleBinding had no labels at all — so the label selector above misses
+#     them entirely. The name-based deletes below are the only thing that
+#     collects them.
+#
+# The two cannot collide: a run-scoped name is always "aicr-<run-id>", never
+# the bare "aicr".
 kc -n gpu-operator delete job -l app.kubernetes.io/name=aicr,app.kubernetes.io/component=snapshot-agent --ignore-not-found
 kc -n gpu-operator delete sa -l app.kubernetes.io/name=aicr,app.kubernetes.io/component=snapshot-agent --ignore-not-found
 kc -n gpu-operator delete role -l app.kubernetes.io/name=aicr,app.kubernetes.io/component=snapshot-agent --ignore-not-found
 kc -n gpu-operator delete rolebinding -l app.kubernetes.io/name=aicr,app.kubernetes.io/component=snapshot-agent --ignore-not-found
+kc -n gpu-operator delete job aicr --ignore-not-found
+kc -n gpu-operator delete sa aicr --ignore-not-found
+kc -n gpu-operator delete role aicr --ignore-not-found
+kc -n gpu-operator delete rolebinding aicr --ignore-not-found
 
 # Phase 3: Component CRDs.
 # Helm does NOT remove CRDs on uninstall — they must be deleted manually or a