587aef820f
The RBAC manifest must be pre-applied via Flux (infra repo) by a privileged actor before the first workflow run. The Arc Runners service account cannot self-apply RBAC — it has no permissions to retrieve the Role to patch it. Fixes PRI-594.