fix(agents): grant agents-api serviceaccounts/configmaps:get to stop 502 on session launch

[ExtraToast]

Problem

Every Claude session launch returns HTTP 502:

POST /api/v1/workspaces/{id}/sessions → 502

The agents-api pod logs show the real cause — an RBAC denial, not a node-selector issue:

serviceaccounts "agent-runner" is forbidden: User
"system:serviceaccount:agents-system:agents-api" cannot get resource
"serviceaccounts" in API group "" in the namespace "agents-system"

On every session launch (and setup-options / restart), Fabric8RunnerBindingInventory.inspect() runs a preflight that does a get on the runner ServiceAccount and the mcp-servers ConfigMap. The namespaced agents-api-runner-controller Role grants pods/pvc/secrets/services but not serviceaccounts or configmaps, so the get throws a 403 that KubernetesExceptionHandler maps to a 502.

This is distinct from the earlier nodes:list fix (#661): nodes is cluster-scoped and handled by the agents-api-node-reader ClusterRole + graceful degradation. serviceaccounts/configmaps are namespaced resources this Role can and should grant.

Fix

Add a read-only rule for serviceaccounts + configmaps to the namespaced Role. Both are included deliberately: serviceaccounts fails first, and configmaps is the very next inspect() check — granting only one would just move the 502 one line down.

Verification

kubectl auth can-i against the agents-api SA before the change:

get serviceaccounts: no
get configmaps:      no
get pods (sanity):   yes

Manifest validated with kubectl apply --dry-run=server (configured cleanly). Flux reconciles the grant on merge.

🤖 Generated with Claude Code