fix(stand): add ClusterRole+CRB for blockstor-satellite ServiceAccount

The Phase 10.6 gRPC cutover moved reconciliation to the satellite
side (resource / RD / snapshot / storagepool reconcilers all run
inside the satellite manager now), but the dev-stand DaemonSet
manifest never got matching RBAC — only the ServiceAccount existed.

The result: every satellite came up, controller-runtime tried to
sync the Snapshot informer cache, hit `cannot list snapshots ... is
forbidden`, the manager exited, and the process continued running
as a no-op zombie. e2e symptoms were every Resource sitting at
"never reached UpToDate on both peers" forever because nobody was
actually rendering .res files or calling drbdadm.

Mirror the controller's permission set (events / leases / all
blockstor.io CRDs r+w / status+finalizers / secrets read). Secrets
read is for the cluster passphrase Secret the encryption reconciler
needs.

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Andrei Kvapil <kvapss@gmail.com>

Author: kvaps

stand/blockstor-satellite-daemonset.yaml

@@ -17,6 +17,45 @@ metadata:
   name: blockstor-satellite
   namespace: blockstor-system
 ---
+# The satellite runs c-r reconcilers for ResourceDefinitions /
+# Resources / Snapshots / StoragePools and writes node-scoped Status
+# back via SSA — it needs full CRUD on blockstor.io CRDs and access
+# to Status / Finalizers subresources, same as the controller. Events
+# permission is for `EventRecorder` traces from reconcile loops.
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: blockstor-satellite
+rules:
+  - apiGroups: [""]
+    resources: [events]
+    verbs: [create, patch]
+  - apiGroups: [""]
+    resources: [secrets]
+    verbs: [get, list, watch]
+  - apiGroups: [coordination.k8s.io]
+    resources: [leases]
+    verbs: [get, list, watch, create, update, patch, delete]
+  - apiGroups: [blockstor.io.blockstor.io]
+    resources: ["*"]
+    verbs: [get, list, watch, create, update, patch, delete]
+  - apiGroups: [blockstor.io.blockstor.io]
+    resources: ["*/status", "*/finalizers"]
+    verbs: [get, update, patch]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: blockstor-satellite
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: blockstor-satellite
+subjects:
+  - kind: ServiceAccount
+    name: blockstor-satellite
+    namespace: blockstor-system
+---
 apiVersion: apps/v1
 kind: DaemonSet
 metadata: