The deploy SA's RBAC is cluster-bootstrap and already lives + is kustomize-applied in the foxhunt repo (infra/k8s/argo/ci-deploy-rbac.yaml). Keeping a second copy here would drift. Single source of truth. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>