Atlas DB runner now uses the least-privilege tuist_ops_ro role

The Helm chart now enables the Atlas DB query runner to run with the least-privilege tuist_ops_ro role in production. This hardens the internal database runner by restricting permissions to read-only access, preventing writes beyond what a read-only transaction alone enforces.