docs: document autoscaler RBAC requirements

[cananoo]

Why are these changes needed?

Custom RBAC configurations can remove the list or watch permissions that the KubeRay operator needs when reconciling in-tree autoscaler resources. The resulting failure mode is difficult to diagnose because controller-runtime may wait for an informer instead of surfacing the authorization error.

This adds an autoscaler-specific RBAC section to the operator chart documentation. It documents the required resources and verbs, explains why list/watch must be retained, and provides a kubectl auth can-i check for restricted installations.

Related issue number

Related to #5186

Checks

• I've made sure the documentation is consistent with the generated operator Role.
• Testing Strategy
  • Manual tests
  • Unit tests
  • This PR is not tested :(

Manual test instructions

• Compared the documented permissions with ray-operator/config/rbac/role.yaml and the Helm RBAC template.
• Updated both README.md.gotmpl and the generated README.md.
• git diff --check passes.

[win5923]

Hi @cananoo, you should update this in the ray doc, not the KubeRay side.

https://github.com/ray-project/ray/blob/master/doc/source/cluster/kubernetes/user-guides/configuring-autoscaling.md

https://docs.ray.io/en/latest/cluster/kubernetes/user-guides/configuring-autoscaling.html

[cananoo]

Thanks for pointing this out. I agree this guidance belongs in Ray's Kubernetes autoscaling guide rather than the KubeRay chart README. I'll prepare the documentation change against ray-project/ray and leave this KubeRay PR open until the replacement is ready, then close it to avoid duplicating the guidance.