fix(adguard): sync job RBAC and idempotency

- grant list+watch on adguard-deployment (rollout status hung
  without it, job hit activeDeadline and failed)
- compare content digests only (old hash embedded filenames, so
  every run patched + restarted even when in sync)

Keeps explicit rollout restart alongside reloader annotation:
one extra restart per rotation (~60d) is accepted for
determinism if reloader is down.

adguardhome/k8s/cert-sync-rbac.yaml

@@ -5,8 +5,9 @@
 #     and create pods/exec (read-only `cat` of /data/letsencrypt/acme.json).
 #     It never writes anything in namespace traefik.
 #   * namespace adguard: get/update/patch Secret `adguard-certs` (the only
-#     secret it may touch) and get/patch Deployment `adguard-deployment`
+#     secret it may touch) and get/list/watch/patch Deployment
-#     (`kubectl rollout restart` issues a patch; `rollout status` reads).
+#     `adguard-deployment` (`rollout restart` issues a patch,
+#     `rollout status` needs list+watch).
 apiVersion: v1
 kind: ServiceAccount
 metadata:
@@ -30,7 +31,7 @@ rules:
   - apiGroups: ["apps"]
     resources: ["deployments"]
     resourceNames: ["adguard-deployment"]
-    verbs: ["get", "patch"]
+    verbs: ["get", "list", "watch", "patch"]
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: RoleBinding

adguardhome/k8s/cert-sync.yaml

@@ -114,8 +114,10 @@ spec:
                     | base64 -d > "$TMP/live.crt"
                   kubectl -n "$NS" get secret "$SECRET" -o jsonpath='{.data.tls\.key}' \
                     | base64 -d > "$TMP/live.key"
-                  NEW_HASH="$(sha256sum "$TMP/new.crt" "$TMP/new.key" | sha256sum | cut -d' ' -f1)"
+                  # Compare content digests only (never filenames: identical
-                  LIVE_HASH="$(sha256sum "$TMP/live.crt" "$TMP/live.key" | sha256sum | cut -d' ' -f1)"
+                  # content under different paths must hash equal).
+                  NEW_HASH="$(sha256sum "$TMP/new.crt" | cut -d' ' -f1)$(sha256sum "$TMP/new.key" | cut -d' ' -f1)"
+                  LIVE_HASH="$(sha256sum "$TMP/live.crt" | cut -d' ' -f1)$(sha256sum "$TMP/live.key" | cut -d' ' -f1)"
                   if [ "$NEW_HASH" = "$LIVE_HASH" ]; then
                     echo "secret ${SECRET} already holds the current ${DOMAIN} cert, nothing to do"
                     exit 0