Fixes EnsureNamespaceSA getting 403 Forbidden when provisioning fission-fetcher SA in dynamically registered namespaces. Adds ClusterRole + ClusterRoleBinding with create/update/patch for serviceaccounts, roles, rolebindings. Also adds doc/progress.md and doc/thinking/2026-04-26-rbac-fix.md.