Narrow TemporalConnection RBAC: finalizer updates currently require main-resource writes

Problem

Downstream deployers want to grant the controller minimum RBAC on TemporalConnection.

The chart already declares a /finalizers RBAC rule:

- apiGroups: [temporal.io]
  resources: [temporalconnections/finalizers]
  verbs: [update]

Ideally, this would move finalizer writes out of the main-resource permission path, while keeping writes scoped to /status and /finalizers.

In practice, the current DeprecatedTCReconciler mutates finalizers via main-object Update:

https://github.com/temporalio/temporal-worker-controller/blob/main/internal/controller/deprecated_tc_reconciler.go#L37-L75

Because this is r.Update(ctx, &tc) on the main resource, Kubernetes RBAC checks update on temporalconnections, not only temporalconnections/finalizers. As a result, downstream charts must still grant main-resource update / patch, which broadens the controller's write surface on user-owned TemporalConnection.spec.

The same pattern appears to exist for the modern Connection kind in internal/controller/worker_controller.go (lines 760-774, lines 817-820), where temporal.io/delete-protection is added/removed via main-object Update.

Desired outcome

One of:

• Switch finalizer mutation in DeprecatedTCReconciler and the equivalent Connection finalizer paths to use the /finalizers subresource explicitly, for example via controller-runtime's finalizers subresource support or an equivalent patch helper.
• Or document in the chart README / RBAC comments that main-resource update / patch on temporalconnections and connections is required for finalizer management, so downstream RBAC reviews can treat it as an intentional requirement rather than over-broad permission.
• Or land an interim doc note now and track a later code refactor.

Context

This came up during a Coinbase InfraSec review of a sandbox deployment of the controller. Sandbox deployment can proceed with documented broad RBAC, but production rollout requires a narrower or better-justified TemporalConnection write surface.

Related issues:

• #311 covers Secret-read RBAC reduction through file-based mTLS.
• #317 reports another impact of finalizer mutation via main-object Update on TemporalWorkerDeployment field ownership.

This issue tracks the RBAC/security impact for TemporalConnection and Connection.