fix: Helm-installed atelet cannot prewarm sandbox assets

[supreme-gg-gg]

Upstream added a feature for sandbox asset prewarming in atelet. Our chart, however, was not updated to include the permission for atelet service account to read cluster-scoped sandboxconfigs.ate.dev resources.

Observed atelet log:

SandboxConfig list/watch failed; sandbox asset prewarm degraded until it recovers
failed to list *v1alpha1.SandboxConfig: sandboxconfigs.ate.dev is forbidden:
User "system:serviceaccount:ate-system:atelet" cannot list resource
"sandboxconfigs" in API group "ate.dev" at the cluster scope

The same permission was added to install manifests upstream:

substrate/manifests/ate-install/atelet.yaml

Lines 34 to 38 in f044fd3

	# SandboxConfigs are watched to pre-download sandbox assets into the node's
	# cache before the first actor needs them (see cmd/atelet/sandbox_prewarm.go).
	- apiGroups: ["ate.dev"]
	resources: ["sandboxconfigs"]
	verbs: ["get", "list", "watch"]