feat(rbac): bundle rbac-proxy + validator-task-submitter ClusterRoles

[bdchatham]

Summary

Two ClusterRoles that the always-on kube-rbac-proxy (PR #267) depends on were template-only under manifests/rbac/ and never bundled — in-cluster verification showed they were missing in dev/harbor/prod, so any new pod cycle would have stalled on the proxy's first TokenReview/SAR.

This PR moves them into config/rbac/ so they ship with the kustomize install:

• rbac-proxy — create tokenreviews + subjectaccessreviews (for kube-rbac-proxy to authenticate callers)
• validator-task-submitter — create + get seinodetasks (the virtual resource the proxy's SAR is keyed on)

Names drop the redundant sei- prefix; kustomize namePrefix: sei-k8s- produces the in-cluster forms sei-k8s-rbac-proxy and sei-k8s-validator-task-submitter. The existing task_submitter_role_binding.yaml roleRef tracks the rename (the previous roleRef name was unprefixed and would not have resolved post-bundle anyway).

Sample bindings in manifests/samples/ updated to reference the prefixed in-cluster names operators will actually see.

Test plan

• kubectl kustomize config/default renders both ClusterRoles with the sei-k8s- prefix
• task_submitter_role_binding.yaml roleRef is rewritten consistently inside the bundle
• make test passes (lint pre-existing failures unrelated to this YAML-only change)
• Cross-review trio (platform / k8s / security) — all ship-approved; list verb trimmed on the K8s reviewer's least-privilege finding (controller only calls create + get)

Deployment ordering

This PR must merge before the corresponding platform-side PR that adds the sei-k8s-rbac-proxy ClusterRoleBinding. The platform overlay pulls config/default?ref=main, so on the next Flux sync after this merges, the ClusterRoles exist and the platform CRB's roleRef resolves. Reverse order = harmless dangling-ref warning until this lands.

Existing pods predate the proxy and are unaffected by either order — only future pod cycles need the chain to be intact.

Deferred follow-ups (filed separately)

• Dedicated SA for kube-rbac-proxy container so seid-node (shared with seictl) stops carrying tokenreviews/subjectaccessreviews
• Generator / admission check so a new SeiNode namespace can't silently miss a CRB subject

🤖 Generated with Claude Code

[cursor]

You have used all Bugbot PR reviews included in your free trial for your GitHub account on this workspace.

To continue using Bugbot reviews, enable Bugbot for your team in the Cursor dashboard.