Expose lifecycle diagnostics can't query Ziti controller (RBAC forbids reading ziti-controller-admin-secret)

[rowan-stein]

Context

In agents-orchestrator PR #189 E2E run 26553883669, TestAgentExposeLifecycle_ListAddRemove fails and the new diagnostics attempt to query Ziti controller state.

However diagnostics currently fail early:

diagnostics: ziti management unavailable: get ziti/ziti-controller-admin-secret: secrets "ziti-controller-admin-secret" is forbidden: User "system:serviceaccount:platform:agents-orchestrator-e2e" cannot get resource "secrets" in API group "" in the namespace "ziti"

So we still cannot see terminators/policies when expose fails.

Run/job: https://github.com/agynio/agents-orchestrator/actions/runs/26553883669/job/78380175641

Task

Decide on one of:

1. Grant limited RBAC so the e2e serviceaccount can read the Ziti admin secret (or a new scoped secret) needed for read-only management queries.
2. Provide a separate read-only Ziti management credential for E2E.
3. Move the Ziti state query into a component that already has access and expose it via a debug endpoint.