fix(ci): add watch permission for Woodpecker CI deployments

Woodpecker CI was timing out when watching deployment rollout status
due to missing RBAC permissions. The deployments were succeeding but
CI couldn't verify completion.

Changes:
- Add 'watch' verb to woodpecker-deployer Role
- Add threesix/default service account to RoleBinding
- Consolidate woodpecker-deployer RBAC into base/rbac.yaml

This resolves the "Failed to watch: deployments.apps is forbidden"
errors in CI logs while maintaining successful deployment rollouts.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

deployments/k8s/base/rbac.yaml

@@ -50,3 +50,38 @@ roleRef:
   kind: Role
   name: rdev-api
   apiGroup: rbac.authorization.k8s.io
+---
+# RBAC for Woodpecker CI to deploy to rdev namespace
+# Allows CI service accounts to apply deployment patches and watch rollout status
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: woodpecker-deployer
+  namespace: rdev
+  labels:
+    app.kubernetes.io/name: woodpecker-deployer
+    app.kubernetes.io/part-of: rdev
+rules:
+  - apiGroups: ["apps"]
+    resources: ["deployments"]
+    verbs: ["get", "list", "patch", "watch"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: woodpecker-deployer
+  namespace: rdev
+  labels:
+    app.kubernetes.io/name: woodpecker-deployer
+    app.kubernetes.io/part-of: rdev
+subjects:
+  - kind: ServiceAccount
+    name: default
+    namespace: rdev
+  - kind: ServiceAccount
+    name: default
+    namespace: threesix
+roleRef:
+  kind: Role
+  name: woodpecker-deployer
+  apiGroup: rbac.authorization.k8s.io