Auto-apply RBAC at cluster start and improve CoreWeave docs (#2983)

Fixes up the docs to cover more of the coreweave workflow and removes
some extra yaml.

- `iris cluster start` now auto-applies RBAC (Namespace, ServiceAccount,
ClusterRole, ClusterRoleBinding) via `ensure_rbac()`, removing the
manual `kubectl apply` prerequisite
- Deleted standalone YAML manifests from `infra/coreweave/k8s/` (now
expressed as Python dicts in `CoreweavePlatform`)
- Rewrote `lib/iris/docs/coreweave.md` with new sections: Tools
(cwic/kubectl/Grafana), RBAC permissions table, config reference,
instance type naming, early failure detection, env vars, timeouts, and
troubleshooting

Author: rjpower

infra/coreweave/k8s/cluster-role-binding.yaml

@@ -167,11 +167,10 @@ it as `/var/lib/containerd`, `/var/lib/kubelet`, `/opt`, etc. The `cache_dir` mu
 NVMe (e.g. `/mnt/local/iris-cache`) — the default `/var/cache/iris` lands on the tiny RAM disk
 and will fill up immediately when installing CUDA packages.
 
-**K8s manifests** (`infra/coreweave/k8s/`):
-- `namespace.yaml`, `service-account.yaml`, `cluster-role.yaml`, `cluster-role-binding.yaml` — RBAC/namespace prerequisites (one-time operator setup)
-
-Controller lifecycle resources (ConfigMap, shared NodePools, Deployment, Service) are created
-automatically by `iris cluster start` via `CoreweavePlatform.start_controller()`.
+All K8s resources (RBAC, ConfigMap, shared NodePools, Deployment, Service) are created
+automatically by `iris cluster start` via `CoreweavePlatform.start_controller()`. RBAC
+manifests (Namespace, ServiceAccount, ClusterRole, ClusterRoleBinding) are defined in
+`CoreweavePlatform.ensure_rbac()` — no separate YAML files needed.
 
 ## Key Modules