Argo Server failing to start without clusterwide access to WorkflowTemplates

### Pre-requisites

- [x] I have double-checked my configuration
- [x] I have tested with the `:latest` image tag (i.e. `quay.io/argoproj/workflow-controller:latest`) and can confirm the issue still exists on `:latest`. If not, I have explained why, **in detail**, in my description below.
- [x] I have searched existing issues and could not find a match for this bug
- [ ] I'd like to contribute the fix myself (see [contributing guide](https://github.com/argoproj/argo-workflows/blob/main/docs/CONTRIBUTING.md))

### What happened? What did you expect to happen?

Argo Server failing to reach a ready state. Seeing logs stuck with the below errors:

```
time="2025-10-02T19:16:37.383Z" level=info authModes="[client sso]" baseHRef=/ managedNamespace=wfe namespace=wfe secure=false ssoNamespace=wfe
time="2025-10-02T19:16:37.962Z" level=info msg="SSO enabled"
time="2025-10-02T19:16:37.966Z" level=info msg="Starting Argo Server" instanceID= version=v3.7.2+cf605b5.dirty
time="2025-10-02T19:16:37.998Z" level=info msg="Creating event controller" asyncDispatch=false operationQueueSize=16 workerCount=4
E1002 19:16:38.006684 1 reflector.go:200] "Failed to watch" err="failed to list argoproj.io/v1alpha1, Resource=workflowtemplates: workflowtemplates.argoproj.io is forbidden: User \"system:serviceaccount:wfe:argo-server\" cannot list resource \"workflowtemplates\" in API group \"argoproj.io\" in the namespace \"wfe\"" logger="UnhandledError" reflector="k8s.io/client-go@v0.33.1/tools/cache/reflector.go:285" type="argoproj.io/v1alpha1, Resource=workflowtemplates"
E1002 19:16:39.335223 1 reflector.go:200] "Failed to watch" err="failed to list argoproj.io/v1alpha1, Resource=workflowtemplates: workflowtemplates.argoproj.io is forbidden: User \"system:serviceaccount:wfe:argo-server\" cannot list resource \"workflowtemplates\" in API group \"argoproj.io\" in the namespace \"wfe\"" logger="UnhandledError" reflector="k8s.io/client-go@v0.33.1/tools/cache/reflector.go:285" type="argoproj.io/v1alpha1, Resource=workflowtemplates"
E1002 19:16:41.649741 1 reflector.go:200] "Failed to watch" err="failed to list argoproj.io/v1alpha1, Resource=workflowtemplates: workflowtemplates.argoproj.io is forbidden: User \"system:serviceaccount:wfe:argo-server\" cannot list resource \"workflowtemplates\" in API group \"argoproj.io\" in the namespace \"wfe\"" logger="UnhandledError" reflector="k8s.io/client-go@v0.33.1/tools/cache/reflector.go:285" type="argoproj.io/v1alpha1, Resource=workflowtemplates"
E1002 19:16:45.741938 1 reflector.go:200] "Failed to watch" err="failed to list argoproj.io/v1alpha1, Resource=workflowtemplates: workflowtemplates.argoproj.io is forbidden: User \"system:serviceaccount:wfe:argo-server\" cannot list resource \"workflowtemplates\" in API group \"argoproj.io\" in the namespace \"wfe\"" logger="UnhandledError" reflector="k8s.io/client-go@v0.33.1/tools/cache/reflector.go:285" type="argoproj.io/v1alpha1, Resource=workflowtemplates"
```

### Version(s)

v3.7.2

### Paste a minimal workflow that reproduces the issue. We must be able to run the workflow; don't enter a workflow that uses private images.

```YAML
N/A
```

### Logs from the workflow controller

```text
N/A
```

### Logs from in your workflow's wait container

```text
N/A
```

Start by reproducing the Argo Server startup failure with the shown version and namespace-scoped service account, then inspect the logged WorkflowTemplates watch/list request and its Kubernetes permissions. Done means Argo Server reaches a ready state without requiring cluster-wide WorkflowTemplate access; the issue names no source file or test to begin with.

Written by the indexing model from the issue text.