fix(rbac): watch host nodes for PVC handoff

[weicao]

Problem

The external-populator PVC handoff uses the host client cache to read the selected host Node. PR9's chart grants the vcluster service account only nodes/get, so the cache cannot list/watch Nodes and the restore handoff remains blocked with nodes is forbidden.

Change

• Grant nodes get, list, and watch under the existing fake-PV PVC handoff condition.
• Update the chart unit assertion to lock the required RBAC contract.

The existing condition remains unchanged, so this permission is added only when PVC sync is enabled, PV sync is disabled, and host Node sync is disabled.

Validation

• helm unittest chart -f tests/clusterrole_test.yaml — 45/45 passed
• helm lint chart — passed
• helm template with fake-PV PVC sync — rendered nodes: get/list/watch
• git diff --check — passed

This is a child fix on PR9's development branch. The completed Oracle R8 environment was not modified or replayed.