Build a Cluster-Wide Read-Only Role

sara@example.com has moved from the on-call rotation to the audit team. Auditors need to inspect the whole cluster — its nodes, its storage and every workload — but must never see credentials or be able to change anything. Their old on-call access has to go.