paperclip: rotate agent-argus SA token Secret via rename to -v3 (REN-544)

The -v2 token leaked into Argus run d2eede8a (REN-542). Renaming makes the
token controller mint a new token; Flux prunes the old Secret, which
invalidates the leaked token.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

kubernetes/apps/paperclip/agent-kubectl-rbac.yaml

@@ -104,7 +104,7 @@ apiVersion: v1
 kind: Secret
 type: kubernetes.io/service-account-token
 metadata:
-  name: agent-argus-token-v2
+  name: agent-argus-token-v3
   namespace: paperclip
   labels:
     app.kubernetes.io/name: paperclip
@@ -189,7 +189,7 @@ rules:
       - agent-atlas-token-v2
       - agent-iris-token
       - agent-hestia-token-v2
-      - agent-argus-token-v2
+      - agent-argus-token-v3
       - agent-hermes-token-v2
 ---
 apiVersion: rbac.authorization.k8s.io/v1