ci(fxhnt): RBAC for the pipeline in foxhunt (SA + deploy role + cross-ns submit)

First real workflow run surfaced two gaps: (1) the WorkflowTemplate's SA
argo-workflow didn't exist in foxhunt (only in argo where msp builds);
(2) argo-events-sa couldn't submit workflows cross-ns into foxhunt. Adds
the SA, a least-privilege deployer Role (apply/scale/annotate/rollout the
dashboard+dagster deployments, exactly what kubectl-deploy runs), the Argo
workflowtaskresults role, and a foxhunt-scoped workflow-submitter binding.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

infra/argo/fxhnt-ci-rbac.yaml

@@ -0,0 +1,114 @@
+# RBAC for the fxhnt CI pipeline — all fxhnt-owned, in the foxhunt namespace (project boundary).
+#
+# Fills the two gaps the first real workflow run surfaced (2026-07-21):
+#   1. The fxhnt-cockpit WorkflowTemplate references SA `argo-workflow`, which existed in `argo` (where msp
+#      builds) but NOT in `foxhunt` (where fxhnt's project boundary places its build/deploy pods).
+#   2. The build-fxhnt Sensor (argo-events-sa) submits Workflows into `foxhunt`; the bizworx `workflow-submitter`
+#      Role only granted that in `argo`, so a cross-namespace submit into foxhunt was forbidden.
+#
+# Least privilege: the workflow SA gets exactly what Argo needs to run pods + what the kubectl-deploy step does
+# (apply/scale/annotate/rollout-status the two daemon Deployments and their Services/NetworkPolicies), nothing more.
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: argo-workflow
+  namespace: foxhunt
+  labels: { app.kubernetes.io/part-of: fxhnt-ci }
+---
+# Argo needs the workflow SA to write task results (the minimum the workflow-controller requires per step).
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: fxhnt-argo-workflow
+  namespace: foxhunt
+  labels: { app.kubernetes.io/part-of: fxhnt-ci }
+rules:
+  - apiGroups: ["argoproj.io"]
+    resources: ["workflowtaskresults"]
+    verbs: ["create", "patch"]
+---
+# The kubectl-deploy step's exact actions on the foxhunt daemons — scoped to what it runs, no wildcards.
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: fxhnt-ci-deployer
+  namespace: foxhunt
+  labels: { app.kubernetes.io/part-of: fxhnt-ci }
+rules:
+  # apply + scale + annotate + rollout-status the daemon Deployments (dashboard, dagster).
+  - apiGroups: ["apps"]
+    resources: ["deployments"]
+    verbs: ["get", "list", "watch", "create", "update", "patch"]
+  - apiGroups: ["apps"]
+    resources: ["deployments/scale"]
+    verbs: ["get", "update", "patch"]
+  - apiGroups: ["apps"]
+    resources: ["replicasets"]
+    verbs: ["get", "list", "watch"]           # rollout status reads the RS
+  # apply the Services the manifests contain, and `wait --for=delete pod` + rollout status read pods.
+  - apiGroups: [""]
+    resources: ["services"]
+    verbs: ["get", "list", "watch", "create", "update", "patch"]
+  - apiGroups: [""]
+    resources: ["pods"]
+    verbs: ["get", "list", "watch"]
+  # the manifests apply a NetworkPolicy (infra/k8s/network-policies/fxhnt-cockpit.yaml).
+  - apiGroups: ["networking.k8s.io"]
+    resources: ["networkpolicies"]
+    verbs: ["get", "list", "watch", "create", "update", "patch"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: fxhnt-argo-workflow
+  namespace: foxhunt
+  labels: { app.kubernetes.io/part-of: fxhnt-ci }
+subjects:
+  - { kind: ServiceAccount, name: argo-workflow, namespace: foxhunt }
+roleRef:
+  kind: Role
+  name: fxhnt-argo-workflow
+  apiGroup: rbac.authorization.k8s.io
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: fxhnt-ci-deployer
+  namespace: foxhunt
+  labels: { app.kubernetes.io/part-of: fxhnt-ci }
+subjects:
+  - { kind: ServiceAccount, name: argo-workflow, namespace: foxhunt }
+roleRef:
+  kind: Role
+  name: fxhnt-ci-deployer
+  apiGroup: rbac.authorization.k8s.io
+---
+# Cross-namespace: let the shared argo-events-sa submit Workflows into foxhunt (the sensor lives in argo-events
+# but its Workflow runs here). Mirrors the bizworx `workflow-submitter` Role, scoped to foxhunt.
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: fxhnt-workflow-submitter
+  namespace: foxhunt
+  labels: { app.kubernetes.io/part-of: fxhnt-ci }
+rules:
+  - apiGroups: ["argoproj.io"]
+    resources: ["workflows"]
+    verbs: ["create", "get", "list", "watch"]
+  - apiGroups: ["argoproj.io"]
+    resources: ["workflowtemplates"]
+    verbs: ["get", "list"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: argo-events-sa-fxhnt-submitter
+  namespace: foxhunt
+  labels: { app.kubernetes.io/part-of: fxhnt-ci }
+subjects:
+  - { kind: ServiceAccount, name: argo-events-sa, namespace: argo-events }
+roleRef:
+  kind: Role
+  name: fxhnt-workflow-submitter
+  apiGroup: rbac.authorization.k8s.io