docs(backups): the kafka walkthrough lists Pod-creating steps under the tenant persona #4625

The kafka backup walkthrough says a tenant can run steps 04, 06 and 07, but those steps create Pods and run commands in them, and no tenant role allows either.

examples/backups/kafka/README.md lists 04-create-kafka.sh, 06-restore-in-place.sh and 07-restore-to-copy.sh under the "tenant" persona. All three seed or read topic data through a CLI Pod (kubectl run --rm -i on main). The tenant roles in packages/system/cozystack-basics/templates/clusterroles.yaml grant get, list and watch on pods, plus delete for tenant admins, and nothing grants create on pods or anything on pods/exec. A tenant following the table gets a Forbidden at the first topic read.

Fix shape: either mark those steps as admin in the table, or split the topic seeding and checking out of them so the tenant part only touches the Kafka and backup resources. The kafka-metadata and nats walkthroughs use the same CLI Pod pattern and are worth checking the same way.