Allow registry overlay hook rollout watch

[cesaregarza]

Summary

• add namespace-level list/watch on deployments for the registry overlay restart hook
• keep patch permission scoped to the four named control-plane deployments

Validation

• kubeconform passed for apps/agent-control-plane-registry-overlay/restart-rbac.yaml
• kubectl apply --dry-run=client passed for apps/agent-control-plane-registry-overlay/restart-rbac.yaml
• git diff --check passed