The platform-engineer ArgoCD local account had apiKey+login capabilities
but no RBAC role assignment. With no argocd-rbac-cm ConfigMap in the repo,
the default policy gave the account zero permissions, so every API call
to list applications returned an empty list — the watchdog could not see
any apps to check their health.
This adds an argocd-rbac-cm ConfigMap with a role:platform-engineer that
has get (read) and sync on all applications in all projects, and assigns
the platform-engineer account to that role.
