deploy both qwen3.6 versions

home-manager/rbac.yaml

@@ -0,0 +1,41 @@
+# Minimal RBAC for the cron-seed Job ONLY.
+#
+# The Hermes home-manager agent itself has NO k8s RBAC — it manages the home
+# via the Home Assistant REST API (http://home-assistant.home-assistant:80).
+#
+# The cron-seed Job needs to `kubectl exec` into the hermes pod to run
+# `hermes cron create ...` (the only way to seed Hermes' internal cron).
+# Scoped to this namespace, pods/exec on the hermes pod only.
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: cron-seeder
+  namespace: home-manager
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: cron-seeder
+  namespace: home-manager
+rules:
+  - apiGroups: [""]
+    resources: ["pods"]
+    verbs: ["get", "list"]
+  - apiGroups: [""]
+    resources: ["pods/exec"]
+    verbs: ["create"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: cron-seeder
+  namespace: home-manager
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: cron-seeder
+subjects:
+  - kind: ServiceAccount
+    name: cron-seeder
+    namespace: home-manager