Atlas DB runner now runs with a least-privilege read-only role

The Helm chart now activates the tuist_ops_ro role for the internal Atlas DB runner. Operator queries now drop to this read-only role, so writes are blocked by database role privileges rather than only by the read-only transaction. This completes the hardening started in earlier pull requests and improves the security posture of self-hosted Tuist server deployments.