fix(adguard): split deployment RBAC rule for list/watch

Collection verbs cannot combine with resourceNames (grant would
be void). Instance verbs stay name-scoped to adguard-deployment;
list/watch is namespace-scoped (single Deployment in ns).

adguardhome/k8s/cert-sync-rbac.yaml

@@ -31,7 +31,14 @@ rules:
   - apiGroups: ["apps"]
     resources: ["deployments"]
     resourceNames: ["adguard-deployment"]
-    verbs: ["get", "list", "watch", "patch"]
+    verbs: ["get", "patch"]
+  # NOTE: list/watch cannot be combined with resourceNames (the API ignores
+  # the name filter for collection verbs, so the grant would be void).
+  # This rule is namespace-scoped to adguard, which holds a single
+  # Deployment; `rollout status` needs it to watch the rollout.
+  - apiGroups: ["apps"]
+    resources: ["deployments"]
+    verbs: ["list", "watch"]
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: RoleBinding