fix: detect non-operational nodegroup stacks

[atharvaHJoshi]

Fixes #8712

Related to #8713.

What this PR does

ROLLBACK_COMPLETE nodegroup stacks were treated as healthy existing nodegroups,
so create nodegroup and delete nodegroup silently did nothing for them, and the
compatibility check logged a misleading "all nodegroups have up-to-date cloudformation
templates" message. A stack in ROLLBACK_COMPLETE was never created successfully and
CloudFormation refuses to update it.

How this differs from #8713

#8713 addresses the misleading log message for a single case. This PR instead:

• treats StackStatusIsNotOperational as a proper category of
  failed/rolled-back states (CREATE_FAILED, ROLLBACK_COMPLETE,
  ROLLBACK_FAILED, UPDATE_ROLLBACK_FAILED, DELETE_FAILED),
• removes ROLLBACK_COMPLETE from the "healthy terminal states" set
  (nonTransitionalReadyStackStatuses, keeping UPDATE_ROLLBACK_COMPLETE),
• makes SetOnlyLocal (used by create nodegroup) fail fast with an actionable
  message when a nodegroup in the user's config already has such a stack,
• surfaces the problem in ValidateExistingNodeGroupsForCompatibility with
  logger.Critical lines instead of silently skipping, and
• corrects the success log to "all nodegroups have compatible shared security
  group configuration".

Changes

• Add StackStatusIsNotOperational helper.
• Remove ROLLBACK_COMPLETE from nonTransitionalReadyStackStatuses.
• Fail fast in the nodegroup filter for non-operational stacks of config nodegroups.
• Reword/report diagnostics in ValidateExistingNodeGroupsForCompatibility.
• Add regression tests for the helper and the filter behavior.

Validation

• go build ./...
• golangci-lint run --timeout=30m ./pkg/...
• go test ./pkg/cfn/...
• go test ./pkg/ctl/cmdutils/filter/...
• go test ./pkg/eks/...

Pre-existing, unrelated failures in pkg/info and pkg/iam/oidc are environmental
(kubectl/cfssl missing locally) and remain unchanged.

[github-actions]

Hello atharvaHJoshi 👋 Thank you for opening a Pull Request in eksctl project. The team will review the Pull Request and aim to respond within 1-10 business days. Meanwhile, please read about the Contribution and Code of Conduct guidelines here. You can find out more information about eksctl on our website