rbac: extend k8s-audit SA for deep-audit script

Add PVC, ArgoCD Application, and Deployment read access
so deep-audit.sh can use least-privilege k8s-audit SA
instead of admin-emergency kubeconfig.

apps/operational-rbac/k8s-audit-rbac.yaml

@@ -46,6 +46,18 @@ rules:
   - apiGroups: ["aquasecurity.github.io"]
     resources: ["vulnerabilityreports"]
     verbs: ["get", "list"]
+  # deep-audit: kubectl get pvc -n dev/staging/prod (orphaned PVC check)
+  - apiGroups: [""]
+    resources: ["persistentvolumeclaims"]
+    verbs: ["get", "list"]
+  # deep-audit: kubectl get app -n argocd (sync status check)
+  - apiGroups: ["argoproj.io"]
+    resources: ["applications"]
+    verbs: ["get", "list"]
+  # deep-audit: kubectl get deploy (version drift check)
+  - apiGroups: ["apps"]
+    resources: ["deployments"]
+    verbs: ["get", "list"]
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding