chore: replace sunbeam.py with cli package; fix VSO test RBAC

Remove scripts/sunbeam.py — superseded by the new cli/ package.
Add install/test/sunbeam targets to justfile pointing at ../cli/.

fix(vso): add deletecollection to test-rbac Role — CachingClientFactory
calls deletecollection on secrets during init; the old Role only had
delete, causing vault-secrets-operator-test to CrashLoopBackOff.

fix(ingress): pingora imagePullPolicy IfNotPresent — Always caused
unnecessary pulls on every pod restart in local dev.

overlays/local/values-pingora.yaml

@@ -12,7 +12,7 @@ spec:
     spec:
       containers:
         - name: pingora
-          imagePullPolicy: Always
+          imagePullPolicy: IfNotPresent
           ports:
             # Bind HTTP/HTTPS directly to the Lima VM's host network
             - name: http