fix(rbac): grant the manager watch on namespaces

The federator resolves WorkloadDeployment source namespaces through an
informer, which needs watch in addition to get/list. With watch
forbidden, the cache only refreshes on periodic re-lists whose backoff
grows as the denied watch keeps retrying, so namespaces created after
manager startup stay invisible for minutes and their WorkloadDeployments
never federate.

Second production RBAC gap surfaced by running the operators in-cluster
under their real ServiceAccount (after the networks grant).

Author: scotwells

config/components/controller_rbac/role.yaml

@@ -31,6 +31,7 @@ rules:
   verbs:
   - get
   - list
+  - watch
 - apiGroups:
   - compute.datumapis.com
   resources: