fix(manifests): fix RoleBinding subject namespace via Kustomize replacement

- Remove duplicated ClusterRole/ClusterRoleBinding from mpp-openshift overlay
  (already covered by base/rbac/control-plane-clusterrole.yaml)
- Keep only the MPP-specific Role/RoleBinding for tenantnamespaces.tenant.paas.redhat.com
- Add Kustomize replacement to inject the overlay namespace into subjects[0].namespace
  so any overlay deploying to a different namespace automatically binds the correct SA

Previously the subject was hardcoded to ambient-code--runtime-int, causing Forbidden
errors when the CP runs in a different namespace (e.g. ambient-code--ambient-s0).

🤖 Generated with [Claude Code](https://claude.ai/code)

Co-Authored-By: Claude <noreply@anthropic.com>

Author: Ambient Code Bot

components/manifests/overlays/mpp-openshift/ambient-control-plane-rbac.yaml

@@ -1,32 +1,4 @@
 apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name: ambient-control-plane-project-namespaces
-rules:
-  - apiGroups: [""]
-    resources: ["secrets", "serviceaccounts", "services"]
-    verbs: ["get", "list", "watch", "create", "delete", "deletecollection"]
-  - apiGroups: [""]
-    resources: ["pods"]
-    verbs: ["get", "list", "watch", "delete", "deletecollection"]
-  - apiGroups: ["rbac.authorization.k8s.io"]
-    resources: ["rolebindings"]
-    verbs: ["get", "list", "watch", "create", "delete"]
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
-  name: ambient-control-plane-project-namespaces
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: ambient-control-plane-project-namespaces
-subjects:
-  - kind: ServiceAccount
-    name: ambient-control-plane
-    namespace: ambient-code--runtime-int
----
-apiVersion: rbac.authorization.k8s.io/v1
 kind: Role
 metadata:
   name: ambient-control-plane-tenant-namespaces

components/manifests/overlays/mpp-openshift/kustomization.yaml

@@ -15,6 +15,18 @@ resources:
 - ambient-control-plane-rbac.yaml
 - ambient-tenant-ingress-netpol.yaml
 
+replacements:
+- source:
+    kind: ServiceAccount
+    name: ambient-control-plane
+    fieldPath: metadata.namespace
+  targets:
+  - select:
+      kind: RoleBinding
+      name: ambient-control-plane-tenant-namespaces
+    fieldPaths:
+    - subjects.0.namespace
+
 patches:
 - path: ambient-api-server-args-patch.yaml
   target: