Fix CSR approval deadlock in assisted installer scale-up

[rut31337]

Problem

CNV cluster provisioning fails with a 3-hour timeout for any lab using host_ocp4_assisted_scale to add worker nodes. Observed on LB2391 and LB2863 — all 12 worker VMs install OCP successfully, reboot, and generate kubelet CSRs, but the CSRs are never approved and the job times out.

Root cause: deadlock between CSR approval and wait_for_hosts

The machine-approver operator rejects CSRs for assisted-installer workers because no Machine API objects exist for them (these nodes are added via assisted installer, not the Machine API). The role handles this with approve_csr_nodes.yaml which manually approves pending CSRs — but it runs after wait_for_hosts.

wait_for_hosts blocks until the assisted installer marks hosts as "ready", which requires nodes to join the cluster, which requires CSR approval → deadlock.

wait_for_hosts (blocks)  →  needs nodes to join cluster
                             →  needs CSR approval
                                →  runs AFTER wait_for_hosts  ← deadlock

Evidence from cluster-lsrl5 (LB2391)

• 12 worker VMs: all Running on CNV host, OCP installed successfully
• 209 pending CSRs, 0 approved (for 5+ hours)
• machine-approver logs: failed to find machine with InternalDNS matching worker-cluster-lsrl5-3, cannot approve
• Manually approving CSRs → all 12 workers joined and went Ready within 60 seconds
• Tower job 28088 on event0: ran for 10803s, killed by 10800s timeout

Fix

1. Move CSR approval before wait_for_hosts — the approve_csr_nodes.yaml task already has a retry loop that waits for the expected number of ready worker nodes. Running it first lets CSRs get approved as workers come up, so by the time wait_for_hosts runs, nodes have already joined.

2. Increase approve_csr_retries from 90 to 180 (15 min → 30 min) — CSR approval now runs before wait_for_hosts and needs to cover the full install + reboot + kubelet startup cycle.

Files changed

File	Change
tasks/main.yaml	Move CSR approval block before wait_for_hosts
defaults/main.yml	approve_csr_retries: 90 → 180