feat(hermes-triage-demo): least-privilege ConfigMap patch for in-process repair

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

services/hermes-triage-demo/rbac.yaml

@@ -83,3 +83,35 @@ subjects:
   - kind: ServiceAccount
     name: hermes-demo-repair
     namespace: hermes-triage-demo
+---
+# The fixture repair runs in-process inside Ariadne rather than as a spawned
+# Kubernetes Job, so Ariadne's own service account needs to patch exactly one
+# ConfigMap in this namespace — nothing else.
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: ariadne-fixture-repair
+  namespace: hermes-triage-demo
+  labels:
+    app.kubernetes.io/part-of: hermes-triage-demo
+rules:
+  - apiGroups: [""]
+    resources: ["configmaps"]
+    resourceNames: ["hermes-triage-demo-fixture"]
+    verbs: ["get", "patch"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: ariadne-fixture-repair
+  namespace: hermes-triage-demo
+  labels:
+    app.kubernetes.io/part-of: hermes-triage-demo
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: ariadne-fixture-repair
+subjects:
+  - kind: ServiceAccount
+    name: ariadne
+    namespace: maintenance