Companion change to toolshed's new multi-replica/autoscaling feature (internal/deploy.Client.ensureAutoscaler in the toolshed repo) — without this, deployer's own attempt to create a HorizontalPodAutoscaler for any app with autoscaling enabled fails with "forbidden" the first time someone actually uses the feature, exactly the failure mode internal/deploy/kubernetes.go's own package doc comment warns about for these two unsynchronized copies of deployer's permission list. Kept in sync with toolshed's own deploy/helm/toolshed/templates/rbac.yaml, which received the identical addition. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Wajog7nELA3i8JWTjxYGHF