bugfixes; research subproc; higher sandbox limits

deploy/k8s/base/gateway-rbac.yaml

@@ -1,6 +1,6 @@
-# RBAC for gateway to CREATE sandbox deployments only
-# Principle of least privilege: gateway can ONLY create deployments/services/PVCs
-# in the sandbox namespace. Deletion is handled by the lifecycle sidecar.
+# RBAC for gateway to manage sandbox deployments
+# Principle of least privilege: gateway can create/delete deployments in the
+# sandbox namespace. PVC deletion is still handled by the lifecycle sidecar.
 # No pods, secrets, exec, or cross-namespace access.
 ---
 apiVersion: v1
@@ -15,10 +15,10 @@ metadata:
   name: sandbox-creator
   namespace: sandbox
 rules:
-  # Deployments: create and read only (deletion handled by sidecar)
+  # Deployments: full management (delete used for license tier changes; PVC deletion still via sidecar)
   - apiGroups: ["apps"]
     resources: ["deployments"]
-    verbs: ["create", "get", "list", "watch", "patch", "update"]
+    verbs: ["create", "get", "list", "watch", "patch", "update", "delete"]
 
   # PVCs: create and read (deletion handled by sidecar)
   - apiGroups: [""]
@@ -41,7 +41,6 @@ rules:
     verbs: ["get"]
 
   # Explicitly NOT included:
-  # - deployments/delete - handled by lifecycle sidecar
   # - pvc/delete - handled by lifecycle sidecar
   # - services/delete - handled by lifecycle sidecar
   # - pods (create/delete) - must go through deployments