fix(rbac): grant woodpecker-deployer access to statefulsets

The CI deploy step runs `kubectl set image statefulset/claudebox` but
the woodpecker-deployer Role only included `deployments`. Add
`statefulsets` to the allowed resources.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

deployments/k8s/base/rbac.yaml

@@ -63,7 +63,7 @@ metadata:
     app.kubernetes.io/part-of: rdev
 rules:
   - apiGroups: ["apps"]
-    resources: ["deployments"]
+    resources: ["deployments", "statefulsets"]
     verbs: ["get", "list", "patch", "watch"]
 ---
 apiVersion: rbac.authorization.k8s.io/v1