Should deployer roles be able to disable and enable apps?

Follow-up from mirendev/runtime#1322, which adds miren app disable and miren app enable.

mirendev/runtime#1322 grants crud.disable and crud.enable to app-admin (own app only, through the existing rpc.AllowApp guard) and to cluster-admin. It leaves them off cluster-deployer. This issue is the open question of whether deployers should get them too.

Why mirendev/runtime#1322 leaves them off

• The in-cluster API docs describe cluster-deployer as "build, deploy, and configure any app (but not create or destroy apps)." Turning an app off isn't building, deploying, or configuring it.
• pkg/workloadroles/roles.go keeps app lifecycle (crud.new/destroy) with cluster-admin so the role names predict what they can do: "Otherwise a 'deployer' could delete every app while app-admin can't even delete its own." Disable is reversible, but a deployer token that can switch off every app on the cluster seems to run into the same surprise.
• A disabled app stays down until someone with enable rights acts. That puts it nearer destroy than restart.

The case for granting them

• crud.restart sits in the appConfig block, so cluster-deployer already has a disruptive per-app operation.
• A deploy pipeline is a natural place to automate a cutover: deploy the app to the new cluster, then disable the old copy. With only admin roles allowed, that pipeline needs a broader token than it otherwise would.
• Disable and enable are reversible and leave the app's versions, routes, environment, disks, and addons intact.

What a change would touch

• pkg/workloadroles/roles.go: add the appLifecycle block that mirendev/runtime#1322 introduces to RoleClusterDeployer (and to RoleAppDeployer, if app-scoped deployers should match), or move the two methods into appConfig alongside restart.
• pkg/workloadroles/roles_test.go: mirendev/runtime#1322 has spot checks asserting deployers can't disable or enable; those would flip.
• docs/docs/in-cluster-api.md: the roles table, where mirendev/runtime#1322 lists disable/enable under app-admin and excludes them from cluster-deployer.