fix(ci): let the runner plan role read the Karpenter chart (#186)

The platform plan fetches a public ECR token. That call was only granted to the apply role.

lib/actions-runner-hcptf-stack.ts

@@ -491,6 +491,18 @@ function planPolicy(hcpArn: string, githubArn: string): object {
         Action: ["kms:ListAliases", "ssm:DescribeParameters"],
         Resource: "*",
       },
+      {
+        Sid: "EcrPublicAuth",
+        Effect: "Allow",
+        Action: "ecr-public:GetAuthorizationToken",
+        Resource: "*",
+      },
+      {
+        Sid: "StsForPublicEcr",
+        Effect: "Allow",
+        Action: "sts:GetServiceBearerToken",
+        Resource: "*",
+      },
       {
         Sid: "EcrReads",
         Effect: "Allow",