feat(helm): add console reader RBAC toggle

[plural-copilot]

Summary

• Adds rbac.consoleReader.enabled, a documented Helm value that defaults to true.
• When set to false, the chart omits the console-read-binding ClusterRoleBinding whose subject is console@plural.sh.

Default compatibility

The default remains true, so existing installations render the same console reader RBAC resources as before.

ClusterRole scope decision

plrl-console-reader is gated by the same value. An exhaustive repository reference inspection found one definition and only one consumer: console-read-binding; that binding's only subject is console@plural.sh. No templates, values files, docs, tests, CI configuration, or other repository files reference the role. The operator's cluster-admin binding and plrl-agent-gate-operator RBAC remain unconditional.

Test coverage and validation

• Updated test/helm/test-chart-install.sh to assert that the default render contains console-read-binding and plrl-console-reader.
• Updated it to render with --set rbac.consoleReader.enabled=false and assert that both are absent.
• Passed: timeout 3m docker run --rm -v "$PWD:/work" -w /work alpine/helm:3.12.3 lint charts/deployment-operator
• Passed: the same lint command with --set rbac.consoleReader.enabled=false
• Passed: Docker Helm template renders for default and disabled values, including explicit presence/absence assertions.
• Passed: bash -n test/helm/test-chart-install.sh
• Passed: git diff --check

Limitations

./test/helm/test-chart-install.sh was attempted but could not execute its Kind installation flow because Helm is not installed on the host (exit 1). Docker is available and was used to run Helm lint and render validation. The chart has no values schema.

[plural-copilot]

This PR was generated by the codex Plural Agent Runtime. Here's some useful information you might want to know to evaluate the ai's perfomance:

Name	Details
💬 Prompt	Implement the Helm RBAC toggle in this standalone repository and open exactly one PR....
🔗 Run history	View run history

[greptile-apps]

Confidence Score: 4/5

The PR appears safe to merge, with a non-blocking opportunity to make the new ClusterRole test assertion resource-specific.

Findings

1.  Role Check Is Ambiguous ▶

Summary

This PR adds an enabled-by-default Helm toggle for the console reader RBAC resources.

• Adds rbac.consoleReader.enabled with a default of true.
• Conditionally renders both plrl-console-reader and console-read-binding.
• Adds enabled and disabled rendering checks, although the role-presence assertion is not resource-specific.

_{Reviews (1) · Last reviewed commit: "feat(helm): add console reader RBAC togg..."}

[greptile-apps]

Role Check Is Ambiguous

The default check does not independently confirm that the plrl-console-reader ClusterRole was rendered. The same name: plrl-console-reader text appears in the binding's roleRef, so removing the role while retaining the binding would still pass this check. Validate the resource kind and metadata name together so this test covers the intended object.