Fix operator RBAC for event recording

[pl4nty]

Summary

Fix operator RBAC for event recording, after controller-runtime breaking change in #4183. Noticed in errors like

E0511 02:03:05.615321 1 event_broadcaster.go:270] "Server rejected event (will not retry!)"
err="events.events.k8s.io is forbidden:
User "system:serviceaccount:toolhive-system:toolhive-operator" cannot create resource "events" in API group "events.k8s.io" in the namespace "toolhive-system""
event="&Event{
  ObjectMeta:{toolhive.18ae607b50e05fea toolhive-system 0 0001-01-01 00:00:00 +0000 UTC <nil> <nil> map[] map[] [] [] []
},
EventTime:2026-05-11 02:03:05.612044577 +0000 UTC m=+798.614640250,Series:nil,
ReportingController:virtualmcpserver-controller,ReportingInstance:virtualmcpserver-controller-toolhive-operator-855bf4f6f8-hcgn7,
Action:UpdateDeployment,Reason:DeploymentUpdated,Regarding:{
  VirtualMCPServer toolhive-system toolhive 002de0e1-8d34-46a7-a339-89ce77f15140 toolhive.stacklok.dev/v1beta1 661778437
},
Related:nil,Note:Deployment updated, rolling out new configuration,Type:Normal,DeprecatedSource:{ },
DeprecatedFirstTimestamp:0001-01-01 00:00:00 +0000 UTC,DeprecatedLastTimestamp:0001-01-01 00:00:00 +0000 UTC,DeprecatedCount:0,}"

Type of change

• Bug fix
• New feature
• Refactoring (no behavior change)
• Dependency update
• Documentation
• Other (describe):

Test plan

• Unit tests (task test)
• E2E tests (task test-e2e)
• Linting (task lint-fix)
• Manual testing (describe below)

API Compatibility

• This PR does not break the v1beta1 API, OR the api-break-allowed label is applied and the migration guidance is described above.

Does this introduce a user-facing change?

No

Implementation plan

Agent-Logs-Url: https://github.com/pl4nty/toolhive/sessions/91c560a3-ef9f-42db-82be-d6fceeadeff7

Special notes for reviewers

[ChrisJBurns]

@pl4nty Thanks for the PR, you'll need to run the helm-docs / pre-commit commands locally to make sure that the docs are all updated with the updated vaues.yaml file

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 68.03%. Comparing base (52dece5) to head (6a1ff82).
⚠️ Report is 19 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #5243      +/-   ##
==========================================
+ Coverage   67.99%   68.03%   +0.04%     
==========================================
  Files         615      616       +1     
  Lines       63019    63005      -14     
==========================================
+ Hits        42848    42865      +17     
+ Misses      16965    16934      -31     
  Partials     3206     3206              

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[pl4nty]

Thanks, fixed! Also noticed I didn't run all the e2e tests, so I've fixed those up too

[jhrozek]

I approved the CI workflows so that the PR runs through tests but you'll want to rebase @pl4nty