fix unwanted removal of last root-dependency HelmRelease

This MR fixes an issue in the code introduced by !3318 (merged).

The root-dependency-check script is supposed to delete all "old" root-dependency-xxx HelmReleases, but actually also deletes the most recent one:

$ k logs root-dependency-120-k6jkx                                                                                                                                          
--- deleting leftover root-dependency-<n> Kustomizations for older versions
kustomization.kustomize.toolkit.fluxcd.io "root-dependency-119" deleted
--- deleting leftover root-dependency-<n> HelmReleases for older versions
helmrelease.helm.toolkit.fluxcd.io "root-dependency-119" deleted
helmrelease.helm.toolkit.fluxcd.io "root-dependency-120" deleted  <<<<<<<<<<<<<<< ouch!
--- deleting leftover root-dependency-<n>-cm ConfigMaps for older versions
--- waiting for Kustomizations to be labeled with sylva-units-helm-revision=120
kustomization.kustomize.toolkit.fluxcd.io/alertmanager-config condition met
kustomization.kustomize.toolkit.fluxcd.io/cabpk condition met
kustomization.kustomize.toolkit.fluxcd.io/cabpr condition met
...

This isn't a huge problem, because the root-dependency Kustomization recreates the HelmRelease afterwards (and does not re-delete it because the root-dependency-check kube-job Job does not run again). But it possibly slows down how fast the apply scripts progress.

This is because the yq query has wrong (!= has precedence over // operator).

Does not do what was intended:

$ kubectl get HelmReleases -o json -l sylva-units.unit=root-dependency \
  | jq -r '.items[] | select(.metadata.labels."sylva-units.version" // "" != "120") | .metadata.name'  
root-dependency-120

Works:

$ kubectl get HelmReleases -o json -l sylva-units.unit=root-dependency \
  | jq -r '.items[] | select((.metadata.labels."sylva-units.version" // "") != "120") | .metadata.name'