feat: Implement RBAC and deployment manifests

[kitsunoff]

⚠️ TDD MANDATORY

Tests MUST be written BEFORE implementation code. No exceptions.

Write tests that verify RBAC permissions work correctly FIRST.

---

Description

Implement RBAC rules and Kubernetes deployment manifests.

Tasks

Test First

• Test: Operator can create/update/delete Jobs
• Test: Operator can read Secrets
• Test: Operator can update CRD status
• Test: Job ServiceAccount can read Secrets
• Test: Job ServiceAccount can update NixosConfiguration status
• Test: Job ServiceAccount CANNOT delete resources

Operator RBAC

• ClusterRole for CRD management (machines, nixosconfigurations)
• ClusterRole for status/finalizers subresources
• Role for Secret read access
• Role for Event creation
• Role for Job management (batch/jobs)
• Role for Pod/log read access
• ServiceAccount for operator
• ClusterRoleBinding and RoleBinding

Job RBAC

• ServiceAccount for apply jobs (minimal permissions)
• Role for Secret read (SSH keys, git credentials)
• Role for NixosConfiguration status update
• Role for Machine read
• RoleBinding for job ServiceAccount

Deployment

• Deployment manifest with proper security context
• Health/readiness probes
• Resource limits
• Leader election configuration

Kustomize

• Base kustomization
• Overlays for dev/prod

Reference

See docs/kubebuilder-migration-analysis.md sections 12, 22.9.