Token-refresher silently produces an empty install plan when rendered manifests are missing

## Problem

When `deploy/token-refresher/rendered/` contains only its tracked `.gitignore` placeholder, direct Go compilation succeeds but the token-refresher component loads no manifests. For an eligible Site, it returns an empty installation plan with a successful reconciliation result.

Direct `go test ./...` in this checkout fails:

```text
--- FAIL: TestPlanAppliesSingletonWhenAnyEligibleSiteEnablesIt
tokenrefresher_test.go:114: planned 0 operations, want 9; deployment found=false
```

The test expects a Deployment, ConfigMap, ServiceAccount, and six RBAC resources.

## Implementation path

Source references at the reviewed revision:

- [embed.go:13–17](https://github.com/Azure/unbounded/blob/001bd869f94b7c23950ce798e865a257a058bdea/deploy/token-refresher/embed.go#L13-L17) embeds `all:rendered`, allowing the placeholder-only directory to satisfy embedding.
- [env.go:213–242](https://github.com/Azure/unbounded/blob/001bd869f94b7c23950ce798e865a257a058bdea/internal/operator/component/env.go#L213-L242) accepts an empty YAML inventory and returns no objects without error.
- [tokenrefresher.go:107–118](https://github.com/Azure/unbounded/blob/001bd869f94b7c23950ce798e865a257a058bdea/internal/operator/components/tokenrefresher/tokenrefresher.go#L107-L118) constructs the empty plan and returns `component.Reconciled()`.
- [tokenrefresher_test.go:65–114](https://github.com/Azure/unbounded/blob/001bd869f94b7c23950ce798e865a257a058bdea/internal/operator/components/tokenrefresher/tokenrefresher_test.go#L65-L114) catches the missing installation resources.

## Existing build prerequisite

`make test` and `make unbounded-operator-build` already depend on `token-refresher-manifests`. Direct Go commands bypass manifest rendering. See [Makefile:546–553](https://github.com/Azure/unbounded/blob/001bd869f94b7c23950ce798e865a257a058bdea/Makefile#L546-L553) and [the rendering target](https://github.com/Azure/unbounded/blob/001bd869f94b7c23950ce798e865a257a058bdea/Makefile#L1235-L1244).

## Reproduction

In a checkout where `deploy/token-refresher/rendered/` contains only `.gitignore`, before running manifest-rendering targets:

```sh
go test ./internal/operator/components/tokenrefresher -run TestPlanAppliesSingletonWhenAnyEligibleSiteEnablesIt -count=1
```

Expected: a clear missing-manifest error or a self-contained test setup.

Observed in the full suite: an empty successful plan, followed by the assertion above.

## Suggested scope

- Reject an empty or incomplete required token-refresher manifest inventory instead of reporting successful reconciliation.
- Add regression coverage for missing embedded resources.
- Document the rendering prerequisite for direct Go testing/building.

## Validation status

Observed the failing full-suite test and inspected the rendered directory, which contained only `.gitignore`. The implementation path above explains the zero-operation result. Rendering manifests and rerunning the test has not yet been verified. No deployed operator failure was exercised.

Discovered during ACL work in #713; this is a separate manifest/build-prerequisite issue, not evidence of an ACL regression.

Start with deploy/token-refresher/embed.go, internal/operator/component/env.go, and internal/operator/components/tokenrefresher/tokenrefresher.go, then run the focused test in tokenrefresher_test.go with the rendered directory containing only .gitignore. Review the existing Makefile manifest-rendering prerequisite and add regression coverage so missing resources cannot produce a successful empty plan; done means the focused test reports the intended missing-manifest behavior or uses a self-contained setup.

Written by the indexing model from the issue text.