fix(e2e): always restart CP for fresh gRPC watch streams

kubectl set env is a no-op when values are unchanged, so the CP
isn't restarted and its gRPC watch streams stay dead from a
previous session. Add explicit rollout restart to ensure fresh
watch connections on every test run.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: jsell-rh

components/ambient-api-server/test/e2e/rbac_e2e_test.sh

@@ -372,7 +372,10 @@ kubectl set env deployment/ambient-control-plane -n "$NS" \
   OIDC_CLIENT_ID="$OIDC_CLIENT_ID_CP" \
   OIDC_CLIENT_SECRET="$OIDC_CLIENT_SECRET_CP" \
   OIDC_TOKEN_URL="$KC_TOKEN_URL"
-echo "  Patched control plane with OIDC credentials"
+# Always restart CP to get fresh gRPC watch streams (set env is a no-op
+# if values unchanged, which means no rollout and stale streams persist)
+kubectl rollout restart deployment/ambient-control-plane -n "$NS" 2>/dev/null || true
+echo "  Patched and restarted control plane"
 echo "  Waiting for control plane rollout..."
 if ! kubectl rollout status deployment/ambient-control-plane -n "$NS" --timeout=120s; then
   echo "FATAL: Control plane rollout failed"