hotfix: fix frontend Hermes token RBAC

[bussyjd]

Summary

• Grant the local frontend service account a namespaced, resourceName-scoped get permission for secret/hermes-api-server in hermes-obol-agent.
• Keep the broader frontend discovery ClusterRole free of Secret permissions.
• Add embed tests that assert the narrow token reader Role/RoleBinding exists and that discovery RBAC does not gain broad Secret access.

Root Cause

The current frontend image reads the Hermes API server token from Kubernetes for the local chat interface, but the bundled obol-frontend RBAC intentionally omitted Secret access. The pod then received a Kubernetes 403 when reading hermes-api-server, which surfaced in the UI as Failed to get agent API token.

Validation

• go test ./internal/embed -count=1
• go test ./internal/embed ./internal/stack -count=1
• go test ./cmd/obol ./internal/tunnel ./internal/stack -count=1
• Live stack: applied the updated frontend RBAC template, confirmed kubectl auth can-i get secret/hermes-api-server -n hermes-obol-agent --as system:serviceaccount:obol-frontend:obol-frontend returns yes.
• Live stack: GET /api/agents/token?id=obol-agent&runtime=hermes returns HTTP 200 with a 32-character token.