chore(hermes-triage-demo): retire repair Job service account and role

The fixture repair now runs in-process inside Ariadne, so the
hermes-demo-repair service account and its Role/RoleBinding have no
remaining user.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

services/hermes-triage-demo/rbac.yaml

@@ -1,18 +1,10 @@
 # services/hermes-triage-demo/rbac.yaml
-# Two scoped grants:
+# Two scoped grants, both least-privilege:
 # 1. Jenkins agent pods (SA jenkins/jenkins) create and observe the demo
 #    test-runner Job and manage the fixture ConfigMap (ensure + seed).
-# 2. The Ariadne-created repair Job runs as SA hermes-demo-repair, which can
-#    patch only the fixture ConfigMap back to healthy.
-# The Ariadne repair path needs no Job-create grant here: its
-# ariadne-job-spawner ClusterRole already covers Job create/watch.
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: hermes-demo-repair
-  namespace: hermes-triage-demo
-  labels:
-    app.kubernetes.io/part-of: hermes-triage-demo
+# 2. Ariadne's own service account patches the fixture ConfigMap back to
+#    healthy. The repair runs in-process inside Ariadne, so there is no
+#    repair Job and no separate repair service account.
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: Role
@@ -55,35 +47,6 @@ subjects:
     name: jenkins
     namespace: jenkins
 ---
-apiVersion: rbac.authorization.k8s.io/v1
-kind: Role
-metadata:
-  name: demo-repair
-  namespace: hermes-triage-demo
-  labels:
-    app.kubernetes.io/part-of: hermes-triage-demo
-rules:
-  - apiGroups: [""]
-    resources: ["configmaps"]
-    resourceNames: ["hermes-triage-demo-fixture"]
-    verbs: ["get", "patch"]
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
-  name: demo-repair
-  namespace: hermes-triage-demo
-  labels:
-    app.kubernetes.io/part-of: hermes-triage-demo
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: Role
-  name: demo-repair
-subjects:
-  - kind: ServiceAccount
-    name: hermes-demo-repair
-    namespace: hermes-triage-demo
----
 # The fixture repair runs in-process inside Ariadne rather than as a spawned
 # Kubernetes Job, so Ariadne's own service account needs to patch exactly one
 # ConfigMap in this namespace — nothing else.