fix: resolve latest addon version before pod identity lookup

[atharvaHJoshi]

Fixes #7841

What this PR does

eksctl update addon failed with Error: getting recommended policies for addon vpc-cni
when the config used version: latest together with pod identity configuration
(e.g. useDefaultPodIdentityAssociations: true).

Root cause

pkg/actions/addon/update.go resolved latest into a concrete version and set it on the
UpdateAddon input, but never wrote it back into addon.Version. Later,
getRecommendedPoliciesForPodID calls the EKS API DescribeAddonConfiguration with
AddonVersion: addon.Version — the literal string "latest" — which the EKS API rejects.
The create-addon path (create.go) already did addon.Version = version correctly.

The error was also swallowed (%s instead of %w), hiding the actual cause.

Changes

• Write the resolved version back into addon.Version after resolving latest
  (same pattern as create.go).
• Wrap the underlying error in the "getting recommended policies" failure so the real
  cause surfaces.
• Add a regression test asserting DescribeAddonConfiguration receives the resolved
  version (not latest) and that UpdateAddon receives the resolved version plus the
  pod identity associations.

Validation

• go build ./...
• golangci-lint run --timeout=30m ./pkg/...
• go test ./pkg/actions/addon/... (127 specs pass)

Pre-existing, unrelated failures in pkg/info and pkg/iam/oidc are environmental
(kubectl/cfssl missing locally) and remain unchanged.

[github-actions]

Hello atharvaHJoshi 👋 Thank you for opening a Pull Request in eksctl project. The team will review the Pull Request and aim to respond within 1-10 business days. Meanwhile, please read about the Contribution and Code of Conduct guidelines here. You can find out more information about eksctl on our website