ClusterRole only had get/list/watch/update/patch on temporalworkers
(inherited from a combined queues+temporalworkers rule), missing create
needed by reconcileTemporalWorker's cross-namespace (sqs -> temporal)
CreateOrUpdate call. Split into separate rule blocks per resource so each
carries its own correct verb set.
Co-Authored-By: Claude Sonnet 5 <[email protected]>