refactor: inline rest config mapper, remove obsolete docs and dead code

Replace ClusterAdminRestConfigMapper with an anonymous closure in
main.go, eliminating the now-unnecessary action/restconfig.go file.
Delete obsolete synthetic-permissions howto documentation.

OPRUN-4630, OPRUN-4631, OPRUN-4632

Co-Authored-By: Claude <noreply@anthropic.com>

Author: pedjak

.claude/TODO-OCPSTRAT-3040.md

@@ -60,7 +60,7 @@ Anyone:      Stream 6 (docs) ← after 4
 - [X] Remove `SyntheticPermissions` feature gate from `features.go` — **OPRUN-4632**
 - [X] Clean up RBAC watches if only needed for pre-auth — **OPRUN-4631** N/A (RBAC watches serve Boxcutter phase ordering)
 - [X] Rewire `main.go`: remove all SA/synthetic/preflight wiring, always use controller's own SA — **OPRUN-4630** `7f5a6843`
-- [ ] Update all unit + e2e tests — **OPRUN-4630, OPRUN-4631, OPRUN-4632**
+- [X] Update all unit + e2e tests — **OPRUN-4630, OPRUN-4631, OPRUN-4632**
 
 > **Ticket close gates:**
 > - OPRUN-4630 closable when all streams 1, 2, 4 items marked with OPRUN-4630 are done

cmd/operator-controller/main.go

@@ -41,6 +41,7 @@ import (
 	"k8s.io/client-go/discovery/cached/memory"
 	corev1client "k8s.io/client-go/kubernetes/typed/core/v1"
 	_ "k8s.io/client-go/plugin/pkg/client/auth"
+	"k8s.io/client-go/rest"
 	"k8s.io/klog/v2"
 	"k8s.io/utils/ptr"
 	"pkg.package-operator.run/boxcutter/managedcache"
@@ -687,7 +688,9 @@ func (c *helmReconcilerConfigurator) Configure(ceReconciler *controllers.Cluster
 	if err != nil {
 		return fmt.Errorf("unable to create core client: %w", err)
 	}
-	clientRestConfigMapper := action.ClusterAdminRestConfigMapper(c.mgr.GetConfig())
+	clientRestConfigMapper := func(_ context.Context, _ client.Object, _ *rest.Config) (*rest.Config, error) {
+		return rest.CopyConfig(c.mgr.GetConfig()), nil
+	}
 
 	cfgGetter, err := helmclient.NewActionConfigGetter(c.mgr.GetConfig(), c.mgr.GetRESTMapper(),
 		helmclient.StorageDriverMapper(action.ChunkedStorageDriverMapper(coreClient, c.mgr.GetAPIReader(), cfg.systemNamespace)),