fix(cicd): skip namespace apply (already exists) + add patch permission

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

.gitea/workflows/deploy.yaml

@@ -234,7 +234,6 @@ jobs:
           # Apply K8s configs if changed
           if echo "$CHANGED_SERVICES" | grep -q "__k8s_config__"; then
             echo "=== Applying K8s configs ==="
-            kubectl apply -f deployments/staging/kubernetes/namespace.yaml
             kubectl apply -f deployments/staging/kubernetes/configmap.yaml
             kubectl apply -f deployments/staging/kubernetes/redis.yaml
             kubectl apply -f deployments/staging/kubernetes/rabbitmq.yaml

deployments/staging/kubernetes/act-runner-rbac.yaml

@@ -33,7 +33,7 @@ rules:
     verbs: ["get", "list", "watch", "create", "update", "patch"]
   - apiGroups: [""]
     resources: ["namespaces"]
-    verbs: ["get", "list", "create"]
+    verbs: ["get", "list", "create", "patch"]
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: RoleBinding