fix(operator): add mlflow.kubeflow.org RBAC to operator ClusterRole (#1286)

## Summary

- Add `mlflow.kubeflow.org/experiments` (`get`, `list`, `update`) to the
`agentic-operator` ClusterRole
- The operator unconditionally grants these permissions in per-session
Roles (`sessions.go:2557`), but its own ClusterRole lacked them
- K8s RBAC escalation prevention blocked every session Role creation on
`vteam-stage`

## Test plan

- [ ] Deploy to `vteam-stage` and confirm sessions start without the
RBAC escalation error
- [ ] Verify operator logs no longer show `user
"system:serviceaccount:ambient-code:agentic-operator" is attempting to
grant RBAC permissions not currently held`

🤖 Generated with [Claude Code](https://claude.com/claude-code)

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Chores**
* Extended operator permissions to manage MLflow Experiment resources
with get, list, and update capabilities.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->

Co-authored-by: Ambient Code Bot <bot@ambient-code.local>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: 3 people

components/manifests/base/rbac/operator-clusterrole.yaml

@@ -72,3 +72,7 @@ rules:
 - apiGroups: [""]
   resources: ["secrets"]
   verbs: ["get", "create", "delete", "update"]
+# MLflow Experiment CRs (operator must hold these to grant them in session Roles)
+- apiGroups: ["mlflow.kubeflow.org"]
+  resources: ["experiments"]
+  verbs: ["get", "list", "update"]