docs(uptime-monitor): correct two comments in the IMC manifests (REN-6)

Both found by Argus in the #995 review and handed to REN-6 as follow-ups.
Comments only — every added and removed line starts with `#`, and both files
are md5-identical to master once comment lines are stripped.

rbac.yaml misstated the failure mode of the omitted pods/services grant. It
claimed a denial "costs a log line, not a reconcile". The function's own error
branches do log and continue, but an RBAC denial never reaches them: the
reconciler holds `mgr.GetClient()` (cmd/main.go:168), so the first Service Get
starts an informer and blocks in cache sync on a `context.TODO()` that nothing
cancels. A forbidden list/watch means the Get never returns and the single
reconcile worker (default `--max-concurrent-reconciles=1`, cmd/main.go:84)
stops entirely, while `/readyz` — `healthz.Ping` — keeps the pod Ready. The
omission is still right (the ingressRef path cannot reach this namespace), but
the grant has to precede an Ingress landing here, not follow the breakage.

crd-endpointmonitors.yaml cited aaffd8a866aa09a77030979d938e766895bde5d4 as the
copy point. That is a master merge commit from 2026-09-25, four months after
the v2.2.13 tag the image is pinned to. Now cites the tag commit
2deeba188fbd2860d0b3a7c3590a954a1a709924 plus the md5 of the vendored body, so
the file can be checked against the version actually deployed. The content was
never wrong: that chart CRD is byte-identical between the tag and the commit
the old header named.

Co-Authored-By: Paperclip <noreply@paperclip.ing>
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

kubernetes/apps/uptime-monitor/crd-endpointmonitors.yaml

@@ -1,8 +1,17 @@
 # VENDORED, DO NOT EDIT BY HAND.
 #
-# Source: stakater/IngressMonitorController chart 2.2.13,
+# Source: stakater/IngressMonitorController at tag v2.2.13 — the tag the image in
+#   deployment.yaml is pinned to — commit 2deeba188fbd2860d0b3a7c3590a954a1a709924,
 #   charts/ingressmonitorcontroller/crds/endpointmonitor.stakater.com_endpointmonitors.yaml
-# Copied verbatim at commit aaffd8a866aa09a77030979d938e766895bde5d4.
+# Everything below this header is byte-identical to that file: md5
+#   f753baa9c9684002ad01d309e98755ba over `apiVersion:` to EOF. The only edits are
+#   this header and the dropped leading `---`.
+#
+# An earlier revision of this header cited aaffd8a866aa09a77030979d938e766895bde5d4
+# instead. That is a master merge commit dated 2026-09-25, four months after the
+# v2.2.13 tag (2026-05-06). The file content was not affected — the chart CRD is
+# unchanged between the tag and that commit — but a citation pointing at a moving
+# branch cannot be used to check this file against the version actually deployed.
 #
 # Vendored rather than installed via HelmRelease because this Kustomization
 # ships hand-written RBAC (see rbac.yaml) — the chart's own Role grants pods,

kubernetes/apps/uptime-monitor/rbac.yaml

@@ -15,11 +15,21 @@
 #     `tryGetHealthEndpointFromIngress` (pkg/kube/wrappers/ingress-wrapper.go:126),
 #     which is reached only from the `urlFrom.ingressRef` path and only when the
 #     EndpointMonitor sets no explicit `healthEndpoint`. It is a best-effort
-#     guess at a readiness-probe path: both the Get and the List log the error
-#     and return `"", false` on failure, so a denial costs a log line, not a
-#     reconcile. Since the ingressRef path can only reach this namespace anyway
-#     (see the ingresses rule below) and nothing here serves HTTP, the grant
-#     would be inert. Add it if an Ingress ever lands in `uptime-monitor`.
+#     guess at a readiness-probe path. Omitted because that path cannot reach
+#     anything here: ingressRef resolves against the EndpointMonitor's own
+#     namespace (see the ingresses rule below) and nothing in `uptime-monitor`
+#     serves HTTP, so the grant would be inert.
+#     It does NOT fail gracefully, so grant it BEFORE an Ingress lands in this
+#     namespace, not after the first EndpointMonitor points at one. The function's
+#     own error branches do log-and-continue, but an RBAC denial never reaches
+#     them: the reconciler's client is `mgr.GetClient()` (cmd/main.go:168), the
+#     cache-backed client, so the first Service Get starts an informer and waits
+#     for it to sync on a `context.TODO()` that nothing cancels. A forbidden
+#     list/watch means that sync never completes, the Get never returns, and the
+#     single reconcile worker (`--max-concurrent-reconciles`, default 1,
+#     cmd/main.go:84) stops processing anything at all. `/readyz` is
+#     `healthz.Ping` (cmd/main.go:182) and keeps answering, so the pod stays
+#     Ready while reconciliation is wedged.
 #   - `route.openshift.io/routes` — OpenShift only; `kube.IsOpenshift` is false
 #     here, so the Route scheme is never even registered (cmd/main.go init()).
 #   - `endpointmonitors/finalizers` — IMC uses no finalizers. Deletion is driven