fix(e2e): make Polaris e2e CI self-sufficient with RBAC in workflow

Canonical fix for PRI-513: resolve Polaris e2e CI failures by applying
RBAC directly in the workflow rather than depending on pre-existing
Flux-managed RBAC that may not have converged.

Changes:
- .github/workflows/e2e.yaml: add workflow steps to apply both
  e2e-ci-runner-rbac.yaml (headlamp-dev namespace) and polaris-rbac.yaml
  (polaris namespace) before the pre-flight check, plus a pre-flight
  RBAC verification step
- deployment/e2e-ci-runner-rbac.yaml: add a Role + RoleBinding for the
  polaris namespace so the CI runner can apply polaris-rbac.yaml

This is the canonical form combining the best elements of stacking PRs:
- Self-sufficient workflow (no external RBAC dependency)
- RBAC pre-flight check for fast failure
- read-write permissions for polaris namespace (same as main stacks)

Supersedes: PRs #122, #124, #125

Co-Authored-By: Paperclip <noreply@paperclip.ing>

deployment/e2e-ci-runner-rbac.yaml

@@ -30,6 +30,34 @@ rules:
   - apiGroups: [""]
     resources: ["serviceaccounts/token"]
     verbs: ["create"]
+  # Apply Polaris dashboard RBAC in the polaris namespace
+  - apiGroups: ["rbac.authorization.k8s.io"]
+    resources: ["roles", "rolebindings"]
+    verbs: ["get", "list", "create", "update", "patch", "delete"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: e2e-ci-runner-polaris
+  namespace: polaris
+rules:
+  - apiGroups: ["rbac.authorization.k8s.io"]
+    resources: ["roles", "rolebindings"]
+    verbs: ["get", "list", "create", "update", "patch", "delete"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: e2e-ci-runner-polaris
+  namespace: polaris
+subjects:
+  - kind: ServiceAccount
+    name: runners-privilegedescalation-gha-rs-no-permission
+    namespace: arc-runners
+roleRef:
+  kind: Role
+  name: e2e-ci-runner-polaris
+  apiGroup: rbac.authorization.k8s.io
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: RoleBinding