fix(ci): deployer RBAC covers configmaps/serviceaccounts/roles/rolebindings

The dashboard+dagster manifests bundle a ConfigMap, ServiceAccount, and the
tailscale-sidecar Role/RoleBinding alongside the Deployment, so kubectl apply
of the whole file needs those types. RBAC-management is scoped to foxhunt
only (documented as a deliberate, namespace-local trade-off).

infra/argo/fxhnt-ci-rbac.yaml

@@ -53,10 +53,22 @@ rules:
   - apiGroups: [""]
     resources: ["pods"]
     verbs: ["get", "list", "watch"]
-  # the manifests apply a NetworkPolicy (infra/k8s/network-policies/fxhnt-cockpit.yaml).
+  # the fxhnt-dashboard + dagster manifests also bundle ConfigMaps + ServiceAccounts (the tailscale sidecar
+  # serve-config + its identity) — kubectl apply of the whole file must be able to read/apply them.
+  - apiGroups: [""]
+    resources: ["configmaps", "serviceaccounts"]
+    verbs: ["get", "list", "watch", "create", "update", "patch"]
+  # the manifests apply NetworkPolicies (fxhnt-cockpit.yaml + dagster's).
   - apiGroups: ["networking.k8s.io"]
     resources: ["networkpolicies"]
     verbs: ["get", "list", "watch", "create", "update", "patch"]
+  # the dashboard + dagster manifests bundle the tailscale-sidecar Role/RoleBinding. NOTE: granting a deployer
+  # SA rbac-management in its own namespace is privilege-escalation-adjacent — it is deliberately scoped to the
+  # foxhunt namespace only (no cluster-wide roles) and exists solely because the app manifests co-locate this
+  # RBAC with the Deployment. Kept minimal (no escalate/bind verbs beyond what apply needs).
+  - apiGroups: ["rbac.authorization.k8s.io"]
+    resources: ["roles", "rolebindings"]
+    verbs: ["get", "list", "watch", "create", "update", "patch"]
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: RoleBinding