Operator ClusterRole grants CRUD on roles/rolebindings cluster-wide

## Description

The operator ClusterRole at `config/rbac/role.yaml:199-211` grants full CRUD on `roles` and `rolebindings` cluster-wide. A compromised operator can grant arbitrary permissions in any namespace.

## Suggested Fix

- Scope to operator's own namespace or use aggregated ClusterRoles
- Remove cluster-wide CRUD on roles/rolebindings