fix: add kubectl/helm install + RBAC for integration-test CI job

- Install kubectl and helm in integration-test runner (DinD image lacks them)
- Configure kubectl with in-cluster service account credentials
- Add ClusterRoleBinding for runner SA to create inttest namespaces
- Add runner-rbac.yaml to runmefirst.sh install sequence

pipelines/arc/runner-rbac.yaml

@@ -0,0 +1,15 @@
+# RBAC for ARC runner pods — allows integration tests to create
+# ephemeral namespaces and deploy sandbox infrastructure.
+# The service account is auto-created by the ARC runner scale set chart.
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: arc-runner-inttest
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: cluster-admin
+subjects:
+  - kind: ServiceAccount
+    name: self-hosted-gremlin-gha-rs-no-permission
+    namespace: arc-system