Constant BINDY_NAMESPACED_ROLE_YAML 

pub const BINDY_NAMESPACED_ROLE_YAML: &str = "# Copyright (c) 2025 Erick Bourgeois, firestoned\n# SPDX-License-Identifier: MIT\n#\n# DO NOT EDIT BY HAND \u{2014} derived from deploy/operator/rbac/role.yaml.\n# If you change role.yaml, re-split it (see README.md in this directory).\n#\n# Apply ONE COPY PER WATCHED NAMESPACE, with metadata.namespace set to that\n# namespace and a matching RoleBinding. The namespace list must equal\n# BINDY_WATCH_NAMESPACES on the operator Deployment, or the operator will watch\n# a namespace it cannot read and crash-loop on 403s.\n---\napiVersion: rbac.authorization.k8s.io/v1\nkind: Role\nmetadata:\n  name: bindy-role\n  namespace: REPLACE_NAMESPACE\n  labels: {app.kubernetes.io/name: bindy, app.kubernetes.io/component: rbac}\nrules:\n- apiGroups: [bindy.firestoned.io]\n  resources: [bind9instances]\n  verbs: [get, list, watch, create, update, patch, delete]\n- apiGroups: [bindy.firestoned.io]\n  resources: [bind9instances/status]\n  verbs: [get, update, patch]\n- apiGroups: [bindy.firestoned.io]\n  resources: [bind9clusters]\n  verbs: [get, list, watch, create, update, patch, delete]\n- apiGroups: [bindy.firestoned.io]\n  resources: [bind9clusters/status]\n  verbs: [get, update, patch]\n- apiGroups: [bindy.firestoned.io]\n  resources: [dnszones]\n  verbs: [get, list, watch, update, patch]\n- apiGroups: [bindy.firestoned.io]\n  resources: [dnszones/status]\n  verbs: [get, update, patch]\n- apiGroups: [bindy.firestoned.io]\n  resources: [arecords, aaaarecords, txtrecords, cnamerecords, mxrecords, nsrecords, srvrecords, caarecords,\n    ptrrecords]\n  verbs: [get, list, watch, update, patch]\n- apiGroups: [bindy.firestoned.io]\n  resources: [arecords/status, aaaarecords/status, txtrecords/status, cnamerecords/status, mxrecords/status,\n    nsrecords/status, srvrecords/status, caarecords/status, ptrrecords/status]\n  verbs: [get, update, patch]\n- apiGroups: [apps]\n  resources: [deployments]\n  verbs: [get, list, watch, create, update, patch, delete]\n- apiGroups: [\'\']\n  resources: [services]\n  verbs: [get, list, watch, create, update, patch, delete]\n- apiGroups: [\'\']\n  resources: [configmaps]\n  verbs: [get, list, watch, create, update, patch, delete]\n- apiGroups: [\'\']\n  resources: [secrets]\n  verbs: [get, list, watch]\n- apiGroups: [\'\']\n  resources: [serviceaccounts]\n  verbs: [get, list, watch, create, update, patch, delete]\n- apiGroups: [\'\']\n  resources: [pods]\n  verbs: [get, list, watch]\n- apiGroups: [\'\']\n  resources: [endpoints]\n  verbs: [get, list, watch]\n- apiGroups: [\'\']\n  resources: [events]\n  verbs: [create, patch]\n- apiGroups: [coordination.k8s.io]\n  resources: [leases]\n  verbs: [get, create, update, patch]\n";

Namespace-scoped split of BINDY_ROLE_YAML: the per-namespace half.

Applied once per watched namespace, with metadata.namespace substituted.