fix(ci): grant ci-deploy SA serviceaccounts/pvc/cronjobs + deployments-watch

The fxhnt-cockpit deploy step applies manifests containing ServiceAccounts (dashboard/dagster), a PVC
(forward track), and a CronJob — none of which the ci-deploy Role permitted, so kubectl apply failed
partway. Also added 'watch' on deployments for 'kubectl rollout status'. Surfaced once the cockpit deploy
finally ran (it previously died at the MinIO log sink first). Rule: this Role must gain a grant for every
new resource KIND a deployed manifest introduces.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

infra/k8s/argo/ci-deploy-rbac.yaml

@@ -7,18 +7,25 @@ metadata:
   labels:
     app.kubernetes.io/part-of: foxhunt
 rules:
+  # apps: roll + apply Deployments. watch is required by `kubectl rollout status`.
   - apiGroups: ["apps"]
     resources: [deployments]
-    verbs: [get, list, patch]
+    verbs: [get, list, watch, patch]
   - apiGroups: ["argoproj.io"]
     resources: [workflowtemplates, eventsources, sensors, eventbus]
     verbs: [get, list, create, update, patch]
+  # core: services/configmaps, plus serviceaccounts (tailscale-dashboard, dagster) and the forward-track PVC
+  # — added so the fxhnt-cockpit deploy can `kubectl apply` its full manifest set without a partial-apply failure.
   - apiGroups: [""]
-    resources: [services, configmaps]
+    resources: [services, configmaps, serviceaccounts, persistentvolumeclaims]
     verbs: [get, list, create, update, patch]
   - apiGroups: ["networking.k8s.io"]
     resources: [networkpolicies]
     verbs: [get, list, create, update, patch]
+  # batch: the fxhnt-forward CronJob
+  - apiGroups: ["batch"]
+    resources: [cronjobs]
+    verbs: [get, list, create, update, patch]
   - apiGroups: ["rbac.authorization.k8s.io"]
     resources: [roles, rolebindings]
     verbs: [get, list, create, update, patch, bind, escalate]