chore(openclaw): golden config snapshot + RBAC manifest in git

- Add openclaw/golden/ with stable copies of openclaw.json, SOUL.md,
  TOOLS.md, HOMELAB.md, kubectl-ro
- Fix HOMELAB.md model roles (qwen3-es:14b=primary, llama3.1-es:8b=fallback)
- Add rbac-openclaw-agent.yaml (ClusterRole read-only + binding + SA)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

openclaw/rbac-openclaw-agent.yaml

@@ -0,0 +1,36 @@
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: openclaw-agent
+  namespace: openclaw
+
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: openclaw-agent-readonly
+rules:
+- apiGroups: [""]
+  resources: [pods, pods/log, services, nodes, namespaces, events]
+  verbs: [get, list, watch]
+- apiGroups: [apps]
+  resources: [deployments, replicasets, statefulsets, daemonsets]
+  verbs: [get, list, watch]
+- apiGroups: [networking.k8s.io]
+  resources: [ingresses]
+  verbs: [get, list, watch]
+
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: openclaw-agent-readonly-binding
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: openclaw-agent-readonly
+subjects:
+- kind: ServiceAccount
+  name: openclaw-agent
+  namespace: openclaw