Fix parsing: use jsonpath for secret read, add debug output for CI visibility

The previous from_yaml fix handled the list case but not the string
case. The root cause is the jq + base64 pipeline returning unexpected
content. Switch to oc get -o jsonpath for reliable raw value extraction,
add debug output to diagnose future parsing issues, and improve the
assert to show actual values on failure.

OCPBUGS-95045

Co-authored-by: Cursor <cursoragent@cursor.com>

Author: tusharjadhav3302

collection/stages/roles/day2ops/tasks/procedures/rotate_app_creds.yml

@@ -13,7 +13,7 @@
 - name: Rotate OpenShift Cloud Credentials
   ansible.builtin.shell: |
     set -o pipefail && \
-    cat {{ clouds_yaml_file_path }} | sed '/^---$/d' | sed 's/{{ user_cloud }}:/openstack:/' | \
+    sed '/^---$/d' {{ clouds_yaml_file_path }} | sed 's/{{ user_cloud }}:/openstack:/' | \
     oc set data -n kube-system secret/openstack-credentials clouds.yaml=-
   environment:
     KUBECONFIG: "{{ kubeconfig }}"
@@ -22,23 +22,28 @@
 - name: Get OpenStack Credentials from OCP cluster
   ansible.builtin.shell: |
     set -o pipefail && \
-    oc get secret -n kube-system openstack-credentials -o json | jq -r '.data."clouds.yaml"' | base64 -d
+    oc get secret -n kube-system openstack-credentials -o jsonpath='{.data.clouds\.yaml}' | base64 -d
   environment:
     KUBECONFIG: "{{ kubeconfig }}"
   register: ocp_creds_output
   changed_when: false
 
+- name: Debug OCP credentials output
+  ansible.builtin.debug:
+    msg: "Secret content type={{ ocp_creds_output.stdout | from_yaml | type_debug }}, first 200 chars={{ ocp_creds_output.stdout[:200] }}"
+
 - name: Parse OCP credentials
-  vars:
-    parsed_yaml: "{{ ocp_creds_output.stdout | from_yaml }}"
   ansible.builtin.set_fact:
-    ocp_creds: "{{ (parsed_yaml is mapping) | ternary(parsed_yaml, parsed_yaml[0]) }}"
+    ocp_creds: "{{ ocp_creds_output.stdout | from_yaml }}"
 
 - name: Verify credentials rotated to application credentials
   ansible.builtin.assert:
     that:
+      - ocp_creds is mapping
+      - ocp_creds.clouds is defined
+      - ocp_creds.clouds.openstack is defined
       - ocp_creds.clouds.openstack.auth_type == 'v3applicationcredential'
-    fail_msg: "Credential rotation failed — auth_type is not v3applicationcredential"
+    fail_msg: "Credential rotation failed — ocp_creds type={{ ocp_creds | type_debug }}, value={{ ocp_creds | to_json | truncate(300) }}"
     success_msg: "Credential rotation verified — auth_type is v3applicationcredential"
 
 - name: Wait until the Cluster Operators are healthy