Add autoscaling/horizontalpodautoscalers to deployer's ClusterRole

Companion change to toolshed's new multi-replica/autoscaling feature
(internal/deploy.Client.ensureAutoscaler in the toolshed repo) — without
this, deployer's own attempt to create a HorizontalPodAutoscaler for any
app with autoscaling enabled fails with "forbidden" the first time
someone actually uses the feature, exactly the failure mode
internal/deploy/kubernetes.go's own package doc comment warns about
for these two unsynchronized copies of deployer's permission list.

Kept in sync with toolshed's own deploy/helm/toolshed/templates/rbac.yaml,
which received the identical addition.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Wajog7nELA3i8JWTjxYGHF

extra-manifests/toolshed-deployer-rbac.yaml

@@ -61,6 +61,15 @@ rules:
   - apiGroups: ["networking.k8s.io"]
     resources: ["networkpolicies"]
     verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
+  # Created only for an app with autoscaling enabled (max replicas set
+  # above min); removed again if it's turned back off. See toolshed's own
+  # internal/deploy.Client.ensureAutoscaler. Added alongside that feature —
+  # keep this file and toolshed's deploy/helm/toolshed/templates/rbac.yaml
+  # in sync, per internal/deploy/kubernetes.go's own package doc warning
+  # that the two are unsynchronized copies in two repositories.
+  - apiGroups: ["autoscaling"]
+    resources: ["horizontalpodautoscalers"]
+    verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding