rbac: name-scoped list/watch grants in every dashboard resource map never authorise a collection request #4044

Every packages/apps/*/templates/dashboard-resourcemap.yaml (19 charts on main) grants the tenant Role resourceNames together with verbs: ["get", "list", "watch"]. RBAC applies resourceNames to list and watch only when the request itself is scoped to that name through fieldSelector=metadata.name=<name>; a plain list of the collection is denied. So the get half of these rules works, and the list/watch half never authorises the collection request a listing UI sends. Nothing is over-granted, but anything that lists services, secrets or workloadmonitors through these Roles has never returned the objects the rule names.

Example from packages/apps/redis/templates/dashboard-resourcemap.yaml:

- apiGroups: [""]
  resources: [secrets]
  resourceNames: ["{{ .Release.Name }}-auth"]
  verbs: ["get", "list", "watch"]

Either drop list/watch from every name-scoped rule so the manifest states what it grants, or, where a consumer really lists, grant list/watch without resourceNames on a label-selected or namespace-scoped path and keep get name-scoped. Which consumer, if any, depends on those two verbs is the first thing to establish; the dashboard resource maps are the obvious candidate.