fix(testkube-runner): grant CRD read to listener-capable agents

[dejanzele]

How

The testkube-runner chart never granted apiextensions.k8s.io/customresourcedefinitions, so agents deployed from it log a recurring Failed to watch ... CustomResourceDefinition ... forbidden and retry forever. The sibling testkube-api chart has had crd-reader-rbac.yaml for this; the runner chart did not.

Adds the equivalent ClusterRole and ClusterRoleBinding, scoped to the same listener.enabled or gitops.enabled condition that already gates watchers-role, and to pod.serviceAccount.autoCreate like the rest of the chart's RBAC.

Scoped rather than unconditional because a runner-only agent has no reason to hold cluster-wide read on every CRD in the cluster. It never starts the CRD informer once #8033 lands, and the Control Plane refuses its inventory push regardless. The two conditions cover both worlds: against a capability-reporting control plane listener.enabled is what earns the agent the listener capability, and against an older one gitops.enabled is what trips the agent's local fallback.

This supersedes #8023, which grants the same access to every runner unconditionally.

A crd_reader_rbac_test.yaml suite covers the gate in both directions, the rule contents, and the binding subject. Chart suite goes from 8 files / 75 tests to 9 / 83.

Note for review

The ClusterRole is named crd-reader-{{ .Release.Name }}, matching the one in testkube-api. Two releases sharing a name would collide on this cluster-scoped object. The existing watchers-role-{{ .Release.Name }} has the same exposure, so this follows the chart family's convention rather than diverging, but it is worth deciding deliberately.

[greptile-apps]

Greptile Summary

Adds conditionally rendered ClusterRole and ClusterRoleBinding resources granting listener- or GitOps-capable runner agents read access to Kubernetes CRDs.

• Gates the CRD permissions on the existing ServiceAccount auto-creation and listener/GitOps settings.
• Adds Helm unit coverage for rendering conditions, permissions, role references, and ServiceAccount subjects.
• Updates the chart test-suite documentation and expected test counts.

Confidence Score: 5/5

The PR appears safe to merge.

No blocking failure remains.

Important Files Changed

Filename	Overview
k8s/helm/testkube-runner/templates/crd-reader-rbac.yaml	Adds scoped CRD read RBAC for listener- or GitOps-enabled agents using chart-created ServiceAccounts.
k8s/helm/testkube-runner/tests/crd_reader_rbac_test.yaml	Verifies the RBAC rendering gates, granted verbs, role reference, and binding subject.
k8s/helm/testkube-runner/tests/README.md	Updates documented suite coverage and expected test totals.

_{Reviews (2): Last reviewed commit: "fix(testkube-runner): grant CRD read to ..." | Re-trigger Greptile}

[dejanzele]

@greptileai