fix: let the fabric identity sweep run without stopping the manager

[scotwells]

What is wrong

fabric-identity-controller is in CrashLoopBackOff on staging since #17 rolled, so no fabric identity is being reconciled at all.

problem running manager: remove the legacy placement policy "cloud-fabric-identity-us-central-1":
  clusterpropagationpolicies.policy.karmada.io "cloud-fabric-identity-us-central-1" is forbidden:
  User "system:fabric-identity-federation@cloud.datumapis.com" cannot delete resource
  "clusterpropagationpolicies" in API group "policy.karmada.io" at the cluster scope

Two mistakes in #17, mine:

1. The credential could not delete. It had create;get;list;patch;update;watch on clusterpropagationpolicies. The sweep deletes, and so does collect via unplace, so delete was needed and neither path could have worked.
2. A sweep failure stopped the manager. It runs as a manager runnable, where a returned error is fatal. A permissions gap in best-effort cleanup took down the whole controller — strictly worse than the leftover policies it was clearing, since a controller that will not start reconciles nothing.

What changed

• delete added to the clusterpropagationpolicies marker; config/rbac/role.yaml regenerated with task generate:rbac (one line).
• The sweep never returns an error. A policy it cannot read or delete is logged at error level, naming the policy and saying it will keep competing for identities, and the manager starts regardless.

The second change is the one that matters: it makes this class of mistake visible rather than fatal.

Test plan

• A sweep that cannot delete is not an error and does not stop the manager
• A sweep that cannot even list the policies is equally survivable
• Making the sweep fatal again fails the new test
• go build, go vet, full go test ./...
• Controller reaches Running on staging and the legacy cloud-fabric-identity-us-central-1 policy is gone