[jtatum]

In watchNamespaces mode, #618 places get namespaces in tenant Roles. Namespace objects are cluster-scoped, so those grants cannot authorize the Pod Security label lookup. The controller then retains the ownership helper default, potentially producing a pod rejected by restricted admission.

Move Namespace reads into the chart's existing cluster-scoped rule set and ClusterRoleBinding. In namespaced mode, constrain resourceNames to the configured watched namespaces. Cluster-wide mode permits reading any Namespace. Neither mode gains Namespace list/watch/write permissions.

This PR targets fix/data-owner-pss-aware as a focused follow-up to #618. It can be retargeted/rebased onto main after that PR merges. The separate namespace-lookup failure handling review on #618 remains relevant; this change fixes the chart permission grant.

Validation:

• A regression test renders the chart, applies its actual RBAC to a disposable envtest API server configured with RBAC, and checks authorization as the rendered operator ServiceAccount identity.
• The original fix: skip init-data-owner in namespaces enforcing restricted Pod Security #618 template fails the watched-Namespace read assertion. The fixed template permits the two watched namespaces, denies unwatched/operator namespaces, and denies Namespace list/watch/patch. Cluster-wide mode is checked too.
• Full make test, make lint, and both Helm RBAC guard scripts pass. CI installs Helm for the authorization test.

[stubbi]

Thanks @jtatum - good catch: in watchNamespaces mode managerRules render as namespaced Roles, where a namespaces rule is inert because Namespace is cluster-scoped. Moving it to clusterScopedRules (narrowed with resourceNames) is correct, and the RBAC-enforcing envtest is exactly the right kind of test. Merging into #618's branch so it ships together with the fixOwnership change; #618's CI covers it against main.