chore: replace sunbeam.py with cli package; fix VSO test RBAC

Remove scripts/sunbeam.py — superseded by the new cli/ package.
Add install/test/sunbeam targets to justfile pointing at ../cli/.

fix(vso): add deletecollection to test-rbac Role — CachingClientFactory
calls deletecollection on secrets during init; the old Role only had
delete, causing vault-secrets-operator-test to CrashLoopBackOff.

fix(ingress): pingora imagePullPolicy IfNotPresent — Always caused
unnecessary pulls on every pod restart in local dev.

base/vso/test-rbac.yaml

@@ -10,7 +10,7 @@ metadata:
 rules:
   - apiGroups: [""]
     resources: ["secrets", "configmaps"]
-    verbs: ["create", "get", "update", "delete", "list", "watch"]
+    verbs: ["create", "get", "update", "delete", "deletecollection", "list", "watch"]
   - apiGroups: ["coordination.k8s.io"]
     resources: ["leases"]
     verbs: ["create", "get", "update", "delete", "list", "watch"]

justfile

@@ -1,5 +1,17 @@
 # Sunbeam infrastructure — local dev convenience targets
 
+# Install the sunbeam CLI package (editable)
+install:
+    pip install -e ../cli/ --break-system-packages
+
+# Run all unit tests
+test:
+    PYTHONPATH=../cli python3 -m unittest discover -s ../cli/sunbeam/tests -p 'test_*.py' -v
+
+# Run any sunbeam CLI verb (e.g.: just sunbeam status ory)
+sunbeam *args:
+    PYTHONPATH=../cli python3 -m sunbeam {{args}}
+
 # Start Lima VM and deploy full stack
 up:
     bash scripts/local-up.sh

overlays/local/values-pingora.yaml

@@ -12,7 +12,7 @@ spec:
     spec:
       containers:
         - name: pingora
-          imagePullPolicy: Always
+          imagePullPolicy: IfNotPresent
           ports:
             # Bind HTTP/HTTPS directly to the Lima VM's host network
             - name: http