security(controller): scope serviceoffer-controller Secret RBAC to named secrets

[bussyjd]

Summary

This PR hardens the serviceoffer-controller Secret RBAC after the agent-backed readiness/teardown fix in #572. It is intentionally stacked on fix/agent-backed-readiness because the RBAC change and the safe teardown guard share the same Secret ownership contract.

The old ClusterRole granted secrets: [get, create, update, patch] cluster-wide with no resourceNames. The reconciler only needs three named Secrets:

Secret	Namespace	Verbs used by code	Why
litellm-secrets	llm	get	read LITELLM_MASTER_KEY
hermes-api-server	agent namespace	get / create / delete	preserve or mint the Hermes API token, then clean it up
remote-signer-keystore	agent namespace	get / create / delete	preserve or mint the wallet keystore, then clean it up

RBAC before -> after

  - apiGroups: [""]
    resources: ["secrets"]
-   verbs: ["get", "create", "update", "patch"]          # cluster-wide
+   resourceNames: ["litellm-secrets"]
+   verbs: ["get"]
+
+ - apiGroups: [""]
+   resources: ["secrets"]
+   resourceNames: ["hermes-api-server", "remote-signer-keystore"]
+   verbs: ["get", "delete"]
+
+ - apiGroups: [""]
+   resources: ["secrets"]
+   verbs: ["create"]                                    # cannot be name-scoped

create stays unscoped because Kubernetes cannot authorize it with resourceNames before the object exists. All disclosure and destructive verbs are now scoped by name, and litellm-secrets is not deletable.

Companion changes

• Adds Secret to isCreateOnlyKind, removing the need for Secret update / patch.
• Removes the legacy in-place keystore-key migration.
• Keeps fresh remote-signer-keystore Secrets labeled with app.kubernetes.io/instance and obol.org/agent, so Fix agent-backed service readiness reconciliation #572's ownership-checked teardown can safely delete only controller-owned resources.
• Tightens TestServiceOfferControllerSecretRBAC_Scoped so it catches broad Secret reads, Secret update/patch/list/watch, and accidental delete access on litellm-secrets.

Tradeoff

Existing pre-fix unlabeled keystore Secrets are reused but not relabeled in place, because relabeling would require keeping Secret update or patch. Freshly-created keystores have the correct ownership labels.

Validation

• go test ./internal/serviceoffercontroller ./internal/embed -count=1
• go test ./internal/serviceoffercontroller ./internal/embed ./internal/x402 ./cmd/obol -count=1
• go test ./internal/serviceoffercontroller/... ./internal/embed/... -count=1
• kubectl --kubeconfig /private/tmp/obol-demo-kubeconfig apply --dry-run=server -f internal/embed/infrastructure/base/templates/x402.yaml

Release smoke was not run in this pass.