fix(spectre): add watch verb to spectre-test Role for kubectl logs -f [sc-17583]

[devkoriel]

Summary

Add watch verb to the spectre-test Role. One-line change plus chart version bump (0.3.5 → 0.3.6).

Why

ArgoCD Sync hooks in app-of-apps use

kubectl logs --tail=0 -f \$POD_NAME | grep -m 1 "tag=DATA_POINT_STORE"

to gate progressive rollouts. The follow-mode stream (-f) needs watch verb on pods/pods/log for RBAC-strict clusters / newer kubectl. The bundled spectre-test Role was ["get", "list"] only.

The app-of-apps layer currently works around this by duplicating a custom check-logs SA + Role + RoleBinding (with watch) inside extraObjects — that's dead-code bloat. Once this lands, app-of-apps can delete all that and use the chart-provided SA directly. Context: Discord thread with @WesleyCharlesBlake 2026-04-21.

Diff

 rules:
 - apiGroups: [""]
   resources: ["pods", "pods/log"]
-  verbs: ["get", "list"]
+  verbs: ["get", "list", "watch"]

• version: 0.3.5 → 0.3.6 in Chart.yaml.

Not in scope

• validator chart already has watch on its own Role (charts/validator/templates/role.yaml:8,11). No change needed.
• app-of-apps cleanup of legacy check-logs extraObjects — follow-up PR, depends on this version being published.

Test plan

• ct lint passes
• ct install passes in kind cluster
• After merge, chart-releaser publishes spectre-0.3.6 to GHCR + chronicleprotocol.github.io/charts
• Follow-up app-of-apps PR can then reference the new chart version via the existing targetRevision: '*.*.*'

Refs:

• sc-17583
• app-of-apps PR #1239 (closing — superseded by this approach per @WesleyCharlesBlake's review)