Redesigns E2E plugin deployment to eliminate all kubectl exec/cp access to
Headlamp pods, per board policy. The new approach:
1. Packages built plugin as a tarball stored in a ConfigMap
2. Patches the Headlamp deployment with an init container that extracts
the plugin into the static-plugins volume before Headlamp starts
3. Waits for rollout and verifies readiness
RBAC is reduced to configmaps (create/get/patch), deployments (get/patch),
replicasets and pods (get/list for rollout status) — no exec or cp needed.
Note: .github/workflows/e2e.yaml update requires workflows permission and
must be applied separately by a user with repo admin access.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Gandalf the Greybeard