fix(helm): grant node read access for GPU capacity checks

[jtoelke2]

Summary

Grant the OpenShell Helm release cluster-scoped read access to Kubernetes nodes so the GPU capacity validation can list node capacity before sandbox creation.

Related Issue

OS-49: https://linear.app/nvidia/issue/OS-49/migrate-github-runners-to-a-supported-solution

Changes

• Add a Helm ClusterRole allowing get/list/watch on core nodes.
• Bind that ClusterRole to the configured OpenShell service account in the release namespace.
• Restore the node read permission required by the Kubernetes driver GPU capacity check.

Testing

• helm template openshell deploy/helm/openshell --namespace openshell
• env PATH=/home/jtoelke/.local/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin SCCACHE_DISABLE=1 mise run pre-commit
• GPU E2E rerun after merge/deploy

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)
• Architecture docs updated (not applicable: Helm RBAC-only fix)

[github-actions]

Label test:e2e-gpu applied for ce4e538. Open the existing run and click Re-run all jobs to execute with the label set. The E2E Gate check on this PR will flip green automatically once the run finishes.