Function build_scout_secrets_reader_role 

pub fn build_scout_secrets_reader_role(
    namespace: &str,
    secret_name: &str,
) -> Role

Build the namespaced Role granting Scout read access to the single remote-cluster kubeconfig Secret (Phase 2 / multi-cluster mode only).

Scoped two ways: namespaced (not a ClusterRole) and resourceNames-restricted to secret_name, so this grants get on exactly one Secret object, not “every Secret in this namespace” and certainly not “every Secret in the cluster” (the previous, now-removed cluster-wide bindy-scout ClusterRole behavior).