Deployed ClusterRole only had get/list/watch/update/patch on temporalworkers, missing create/delete needed by reconcileTemporalWorker's cross-namespace (sqs -> temporal) CreateOrUpdate call, and never granted apps/deployments at all -- both required for the auto-provisioned TemporalWorker + backing Deployment to reconcile successfully. Co-Authored-By: Claude Sonnet 5 <[email protected]>