fix(ci): grant runner os:operator for talosctl image pull

[Tanguille]

os:reader (set in #4063) lacks the ImagePull API. /machine.MachineService/ImagePull requires os:admin or os:operator, so every image-pull run has failed with PermissionDenied: not authorized (e.g. #4084). os:operator is the minimal role that includes ImagePull — restores image pre-pull without re-granting admin.

[tanguille-cluster]

@@ spec.roles.0 @@
# talos.dev/v1alpha1/ServiceAccount/actions-runner-system/cluster-runner
! ± value change
- os:reader
+ os:operator

[github-actions]

AI Automated Review

Analysis engine: qwen-3.6-fast@http://litellm.ai.svc.cluster.local/v1 (openai)

Recommendation: Approve

This PR correctly upgrades the Talos ServiceAccount role for the Actions Runner from os:reader to os:operator, which is required for the /machine.MachineService/ImagePull API used in CI image pre-pulling. The change is minimal, well-documented, and follows the principle of least privilege by choosing os:operator over os:admin.

Change-by-Change Findings

1. Role upgrade: Changed roles: ["os:reader"] to roles: ["os:operator"] in kubernetes/apps/actions-runner-system/actions-runner-controller/runners/cluster/rbac.yaml. This fixes the PermissionDenied: not authorized errors reported in PR 4084 caused by os:reader lacking ImagePull permissions. The comment update accurately reflects the rationale.

Standards Compliance

• ✅ Follows Conventional Commit format (fix(ci): ...).
• ✅ Small, focused change affecting only one file.
• ✅ Uses os:operator (not os:admin) as the minimal sufficient role, consistent with security best practices.
• ✅ No secrets, credentials, or SOPS files modified.
• ✅ No shell scripts touched; no shellcheck validation needed.

Must-Check Items

1. Review auth flow for regression: The change upgrades from os:reader to os:operator. Per Talos documentation, os:operator grants broader access than os:reader but is still significantly more restricted than os:admin. It includes ImagePull and other operational APIs needed for runner tasks. Since the comment confirms the only use case is talosctl image pull, this is the minimal role that satisfies the requirement. No regression risk identified.
2. Verify session token handling is correct: Not applicable — this change modifies a static Talos ServiceAccount role binding in Kubernetes manifests, not runtime session/token logic. Token handling is managed by the Talos API and ARC controller, neither of which are changed here.

Unknowns or Needs Verification

• The referenced issue PR 4084 was not found in git log or grep results; however, the PR body provides sufficient context about the failure mode (PermissionDenied: not authorized). If PR 4084 exists as a GitHub issue rather than a commit reference, it is outside the scope of local verification.