Rename E2E namespace to headlamp-dev; fix RBAC manifest

Per CEO directive on PRI-324: the actual cluster namespace for
shared E2E runs is `headlamp-dev`. References to `privilegedescalation-dev`
in the workflow, scripts, and runner RBAC were stale and prevented the
runner SA from acquiring permissions where they were granted on-cluster.

Also fixes the malformed `e2e-ci-runner-polaris` Role added in 0cd9eb0
which incorrectly carried `subjects:` and `roleRef:` (RoleBinding-only
fields) — kept rules-only on the Role and the binding in the matching
RoleBinding below.

Applies QA nits from PR #123: collapsed MISSING_ROLE/MISSING_ROLEBINDING
into a single MISSING flag in the pre-flight step. Dropped the
non-standard `--quiet` flag on get calls (already redirected to /dev/null).

.github/workflows/e2e.yaml

@@ -11,7 +11,7 @@ permissions:
   contents: read
 
 # Only one E2E run at a time: the shared E2E_RELEASE (headlamp-e2e) in
-# privilegedescalation-dev cannot be shared across concurrent runs.
+# headlamp-dev cannot be shared across concurrent runs.
 # cancel-in-progress: false (queue, don't cancel) — cancelling in-flight
 # runs may skip the if: always() teardown, leaving dangling cluster resources.
 concurrency:
@@ -19,7 +19,7 @@ concurrency:
   cancel-in-progress: false
 
 env:
-  E2E_NAMESPACE: privilegedescalation-dev
+  E2E_NAMESPACE: headlamp-dev
   E2E_RELEASE: headlamp-e2e
   # Pin to a known-good Headlamp version. Using :latest is risky because
   # the tag can change between CI runs, causing flaky failures when a newer
@@ -51,8 +51,10 @@ jobs:
       - name: RBAC pre-flight check
         run: |
           echo "Checking RBAC resources in polaris namespace..."
-          if kubectl get role polaris-dashboard-proxy-reader -n polaris -o name >/dev/null 2>&1 && \
-             kubectl get rolebinding polaris-dashboard-proxy-reader -n polaris -o name >/dev/null 2>&1; then
+          MISSING=0
+          kubectl get role polaris-dashboard-proxy-reader -n polaris -o name >/dev/null 2>&1 || MISSING=1
+          kubectl get rolebinding polaris-dashboard-proxy-reader -n polaris -o name >/dev/null 2>&1 || MISSING=1
+          if [ "$MISSING" -eq 0 ]; then
             echo "RBAC pre-flight check passed."
           else
             echo "::error::Role or RoleBinding not found in polaris namespace after apply."