Fix RBAC: add create permission for workflows

- Add create and delete verbs to workflows resource in ClusterRole
- Add backstage-argo-workflows ServiceAccount to ClusterRoleBinding

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

environment-provisioner/workflow-rbac.yaml

@@ -50,10 +50,10 @@ rules:
     resources: ["applications"]
     verbs: ["create", "get", "list", "patch", "update", "delete"]
 
-  # Argo Workflows - for labeling workflows
+  # Argo Workflows - for creating and managing workflows
   - apiGroups: ["argoproj.io"]
     resources: ["workflows"]
-    verbs: ["get", "list", "patch", "update"]
+    verbs: ["create", "get", "list", "patch", "update", "delete"]
 
 ---
 # Bind the workflow-executor role to the service accounts in argo-workflows namespace
@@ -75,3 +75,6 @@ subjects:
   - kind: ServiceAccount
     name: argo-workflows-server
     namespace: argo-workflows
+  - kind: ServiceAccount
+    name: backstage-argo-workflows
+    namespace: argo-workflows