JIT write tier can mutate Kura CRs

Operators elevated via the JIT tuist-<env>-write tier can now mutate Kura custom resources (KuraInstance, KuraGateway) directly, without needing the break-glass system:masters kubeconfig. The change introduces a tuist-edit-kura-write ClusterRole that aggregates into the built-in edit role and grants the full mutate verb set on kura.tuist.dev, so routine tasks like recreating KuraInstance/KuraGateway during a region cutover no longer require escalation. Scope is limited to Kura CRs; CAPI/infra CRs remain read-only for the edit tier.