chore: replace sunbeam.py with cli package; fix VSO test RBAC

Remove scripts/sunbeam.py — superseded by the new cli/ package.
Add install/test/sunbeam targets to justfile pointing at ../cli/.

fix(vso): add deletecollection to test-rbac Role — CachingClientFactory
calls deletecollection on secrets during init; the old Role only had
delete, causing vault-secrets-operator-test to CrashLoopBackOff.

fix(ingress): pingora imagePullPolicy IfNotPresent — Always caused
unnecessary pulls on every pod restart in local dev.

justfile

@@ -1,5 +1,17 @@
 # Sunbeam infrastructure — local dev convenience targets
 
+# Install the sunbeam CLI package (editable)
+install:
+    pip install -e ../cli/ --break-system-packages
+
+# Run all unit tests
+test:
+    PYTHONPATH=../cli python3 -m unittest discover -s ../cli/sunbeam/tests -p 'test_*.py' -v
+
+# Run any sunbeam CLI verb (e.g.: just sunbeam status ory)
+sunbeam *args:
+    PYTHONPATH=../cli python3 -m sunbeam {{args}}
+
 # Start Lima VM and deploy full stack
 up:
     bash scripts/local-up.sh