workload-cluster-operator can't patch events correctly

❯ kubectl logs -n workload-cluster-operator-system pods/workload-cluster-operator-controller-manager-5475c7f9c9-pmtcr
2026-08-19T14:09:29Z    ERROR   events  Server rejected event (will not retry!) {"event": "&Event{ObjectMeta:{dev.18cd39d7842c1d44  test    0 0001-01-01 00:00:00 +0000 UTC <nil> <nil> map[] map[] [] [] []},EventTime:2026-08-19 14:03:44.93418618 +0000 UTC m=+4238.762461864,Series:&EventSeries{Count:2,LastObservedTime:2026-08-19 14:03:45.06223128 +0000 UTC m=+4238.890506948,},ReportingController:SylvaWorkloadCluster,ReportingInstance:SylvaWorkloadCluster-workload-cluster-operator-controller-manager-5475c7f9c9-pmtcr,Action:Successfully reconciled SylvaWorkloadCluster %s,Reason:ReconciliationSucceeded,Regarding:{SylvaWorkloadCluster test dev af4ade9f-228c-4048-ad6c-557fa8b273a1 workloadclusteroperator.sylva/v1alpha1 113822 },Related:nil,Note:dev,Type:Normal,DeprecatedSource:{ },DeprecatedFirstTimestamp:0001-01-01 00:00:00 +0000 UTC,DeprecatedLastTimestamp:0001-01-01 00:00:00 +0000 UTC,DeprecatedCount:0,}", "error": "events.events.k8s.io \"dev.18cd39d7842c1d44\" is forbidden: User \"system:serviceaccount:workload-cluster-operator-system:workload-cluster-operator-controller-manager\" cannot patch resource \"events\" in API group \"events.k8s.io\" in the namespace \"test\""}
k8s.io/client-go/tools/events.recordEvent
        /go/pkg/mod/k8s.io/client-go@v0.36.1/tools/events/event_broadcaster.go:270
k8s.io/client-go/tools/events.(*eventBroadcasterImpl).refreshExistingEventSeries
        /go/pkg/mod/k8s.io/client-go@v0.36.1/tools/events/event_broadcaster.go:133
k8s.io/apimachinery/pkg/util/wait.BackoffUntilWithContext.func1
        /go/pkg/mod/k8s.io/apimachinery@v0.36.1/pkg/util/wait/backoff.go:255
k8s.io/apimachinery/pkg/util/wait.BackoffUntilWithContext
        /go/pkg/mod/k8s.io/apimachinery@v0.36.1/pkg/util/wait/backoff.go:256
k8s.io/apimachinery/pkg/util/wait.JitterUntilWithContext
        /go/pkg/mod/k8s.io/apimachinery@v0.36.1/pkg/util/wait/backoff.go:223
k8s.io/apimachinery/pkg/util/wait.UntilWithContext
        /go/pkg/mod/k8s.io/apimachinery@v0.36.1/pkg/util/wait/backoff.go:172

In the controller code the annotation shows that it should be able to patch and create events. See https://gitlab.com/sylva-projects/sylva-elements/workload-cluster-operator/-/blob/main/internal/controller/sylvaworkloadcluster_controller.go?ref_type=heads#L114