refactor: Build RBAC with recommended labels (#731)

* factor: add infallible rbac functions

* switch op-rs to main branch, regenerate nix

* changelog

* rename resource name functions

* regenerate charts

* added role impl From, more for compatability as only a single, fixed comment

* added missing From impl instance

* moved tests and made them more thorough

* move object_meta to build step

* make metastore role non-optional

* extend test validate_ok_derives_expected_values to check more values

* change validate_rejects_invalid_role_group_name to show entire yaml

* change validate_rejects_invalid_env_var_override_name to show entire yaml

* Update rust/operator-binary/src/controller.rs

Co-authored-by: Siegfried Weber <mail@siegfriedweber.net>

* Update rust/operator-binary/src/controller.rs

Co-authored-by: Siegfried Weber <mail@siegfriedweber.net>

* Update CHANGELOG.md

Co-authored-by: Siegfried Weber <mail@siegfriedweber.net>

* move swap-guard comment to the fixture that defines the cluster name

---------

Co-authored-by: Siegfried Weber <mail@siegfriedweber.net>

Author: adwk67

CHANGELOG.md

@@ -8,9 +8,14 @@ All notable changes to this project will be documented in this file.
 
 - Internal operator refactoring: introduce a build() step in the reconciler that
   assembles all relevant Kubernetes resources before anything is applied ([#726]).
+- The RBAC ServiceAccount and RoleBinding are now built with the operator-rs `v2::rbac`
+  functions and carry the full set of recommended labels ([#731]).
+- BREAKING: The `metastore` role is now required by the CRD; a HiveCluster without it was
+  previously accepted by the API server but failed reconciliation ([#731]).
 - Bump stackable-operator to 0.114.0 ([#735]).
 
 [#726]: https://github.com/stackabletech/hive-operator/pull/726
+[#731]: https://github.com/stackabletech/hive-operator/pull/731
 [#735]: https://github.com/stackabletech/hive-operator/pull/735
 
 ## [26.7.0] - 2026-07-21