fix(operator): cut the ClusterRole to the verbs the loop issues (#297 part 2)

[v0l]

Part 2 of #297 (scoped RBAC). Part 1 is #298; part 3 (dedicated DB credentials) follows.

Every rule in the ClusterRole is now a verb the reconcile loop actually issues. Full inventory of Kubernetes calls in lnvps_operator/src (there are 16, all listed):

resource	calls	verbs
namespaces	list :1629, delete :1637, apply :1000	list, create, patch, delete
secrets	get("generated") :1036, apply :1315, :1341	get, create, patch
services, configmaps, persistentvolumeclaims	apply :1344, :1338, :1334	create, patch
resourcequotas	delete("quota") :296	delete
pods	list :1517	list
apps/deployments	list :1507, apply :1345	list, create, patch
ingresses	get/create/replace/delete nostr_domains.rs:262-448, apply :1381	get, create, update, patch, delete
networkpolicies	apply :1310	create, patch

Line numbers are lnvps_operator/src/app_deployments.rs unless noted.

What comes out:

• events — dead. Nothing in lnvps_operator/src constructs an Event or a recorder.
• watch everywhere — the loop is a polling reconcile; there is no watcher() and no Controller in the tree.
• update except on ingresses — everything else is server-side apply, which is patch. create stays beside patch because the first pass creates the object.
• get/list where nothing reads back — services, configmaps, PVCs, networkpolicies are written and never read.
• delete on the per-namespace objects — teardown deletes the namespace, and Kubernetes garbage-collects what is inside it.

Secret access stays cluster-wide, and the README now says so plainly rather than leaving it implied. Scoping it to app-N cannot be done by moving the rule to a Role: RBAC refuses to let a subject grant permissions it does not hold, so the operator would still need the cluster-wide verbs in order to create the binding. The route that works — a second ClusterRole plus bind by resourceNames, and a RoleBinding written per namespace at reconcile time — is code and a two-step rollout, filed as #299.

No test: this is the example manifest. cargo test --workspace unchanged and green (lnvps_e2e aside, which needs live services).

This one has a live failure mode #298 does not. Applying it takes permissions away. If the running operator is doing something this inventory missed, it starts 403-ing on the next pass. It also must not be applied as a whole file while #295 is open — the ClusterRoleBinding subject in this manifest names a namespace the operator may not run in. Applying the ClusterRole alone is the safe half, and that is Kieran's call.

Channel: lnvps (f5894ea9-44c7-56fb-bd9b-6e3e671e4bc1)