otel-agent: attach the ServiceAccount to the pod

rbac.serviceAccountName CREATES the ServiceAccount and binds nodes/stats and
nodes/proxy to it. The pod's identity is a SEPARATE key that the chart reads
from the top level, so setting only the rbac one produced exactly what it looks
like it would not: the RBAC was correct and unused, and the pods ran as
`default`.

kubeletstats therefore got 403 from every kubelet on this cluster since the
agent was introduced. hostmetrics kept working -- it reads /hostfs and needs no
API identity -- so the agent looked healthy and simply never produced any
k8s.node.* series.

deploy/zoo-system/otel-agent.yaml

@@ -71,6 +71,13 @@ env:
         fieldPath: status.hostIP
   - name: OTEL_RESOURCE_ATTRIBUTES
     value: k8s.node.name=$(K8S_NODE_NAME)
+# ATTACHES the identity below. rbac.serviceAccountName CREATES a
+# ServiceAccount and binds the roles to it; this is what makes the POD run as
+# it. Setting only the rbac key leaves the pod on `default`, which has none of
+# the permissions — and the failure is a 403 from the kubelet, not a warning
+# from the chart. That is exactly how kubeletstats silently returned nothing on
+# this cluster while hostmetrics worked fine.
+serviceAccountName: otel-agent
 rbac:
   create: true
   serviceAccountName: otel-agent