chore: Describe RBAC rules, remove unnecessary rules

[NickLarsenNZ]

Part of stackabletech/issues#798

Note

This was initially generated by a coding assistant to see how well it can inspect code and review the RBAC rules. the changes will be properly checked before reviews are requested.

• Document each rule
• Check the docs make sense. Rewrite where necessary
• Remove unnecessary permissions
• Attach explanations to PR description
• Run all tests
• Split operator and product roles into separate files

Explanation

The file deploy/helm/airflow-operator/templates/roles.yaml was audited. Every RBAC rule now
has a comment explaining why it exists. The following unnecessary permissions were removed:

Permission removed	Reason
batch/jobs (entire rule)	Leftover from the old AirflowDB controller removed in PR #322. DB init now runs as part of the scheduler entrypoint. The delete_orphaned_resources framework does attempt cleanup on Jobs, but silently skips on 403, and since no Jobs are ever created there is nothing to clean up.
pods from operator ClusterRole	The operator never directly creates or manages Pods. Pods are created by StatefulSets. (Pods remain in the product ClusterRole where Airflow's KubernetesExecutor needs them.)
endpoints	Never created or managed by the operator. Auto-created by Kubernetes for Services. Present since the original operator template boilerplate.
update verb on all operator ClusterRole resources	The operator exclusively uses Server-Side Apply (SSA = PATCH), never PUT (update/replace). Confirmed by searching for client.update() calls — none exist.
watch on rolebindings, poddisruptionbudgets, listeners	These resources are not watched by the controller (no .owns() or .watches() call). They only need verbs for SSA (create + patch) and orphan cleanup (list + delete), plus get for the ReconciliationPaused path.
patch on the primary CRD (airflowclusters)	The operator only patches airflowclusters/status (separate rule), never the main resource itself. The controller only needs get + list + watch on the main CRD.