fix: don't set cross-namespace owner ref on TemporalWorker

Queue lives in the sqs namespace while its TemporalWorker is created
in the Temporal namespace (KMSVC_TEMPORAL_NAMESPACE), so
SetControllerReference always failed with "cross-namespace owner
references are disallowed". Drop the owner ref (lifecycle already
handled explicitly in reconcileDelete) and move Spec population into
the CreateOrUpdate mutate closure so updates to an existing
TemporalWorker actually stick.

Also commit the generated TemporalWorker CRD and RBAC rules
(temporalworkers, deployments) that were previously untracked.

config/rbac/role.yaml

@@ -12,6 +12,18 @@ rules:
   - apiGroups: ["kmsvc.io"]
     resources: ["queues/finalizers"]
     verbs: ["update"]
+  - apiGroups: ["kmsvc.io"]
+    resources: ["temporalworkers"]
+    verbs: ["get", "list", "watch", "update", "patch"]
+  - apiGroups: ["kmsvc.io"]
+    resources: ["temporalworkers/status"]
+    verbs: ["get", "update", "patch"]
+  - apiGroups: ["kmsvc.io"]
+    resources: ["temporalworkers/finalizers"]
+    verbs: ["update"]
+  - apiGroups: ["apps"]
+    resources: ["deployments"]
+    verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
   - apiGroups: ["coordination.k8s.io"]
     resources: ["leases"]
     verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]

internal/operator/queue_controller.go

@@ -257,18 +257,15 @@ func (r *QueueReconciler) reconcileTemporalWorker(ctx context.Context, queue *km
 			Name:      workerName,
 			Namespace: workerNamespace,
 		},
-		Spec: kmsvcv1.TemporalWorkerSpec{
-			Namespace: namespace,
-			Image:     workerImage,
-			Replicas:  &replicas,
-		},
-	}
-
-	if err := controllerutil.SetControllerReference(queue, worker, r.Client.Scheme()); err != nil {
-		return fmt.Errorf("set controller reference: %w", err)
 	}
 
+	// Queue and TemporalWorker live in different namespaces (sqs vs. the Temporal
+	// namespace), so a controller owner reference is disallowed by the API server.
+	// Lifecycle is instead managed explicitly in reconcileDelete.
 	if _, err := controllerutil.CreateOrUpdate(ctx, r.Client, worker, func() error {
+		worker.Spec.Namespace = namespace
+		worker.Spec.Image = workerImage
+		worker.Spec.Replicas = &replicas
 		return nil
 	}); err != nil {
 		return fmt.Errorf("create or update TemporalWorker %s: %w", workerName, err)