api-syncagent need event permissions for default namespace

[blut]

Currently the api-syncagent has event permissions in the release namespace, but events on cluster-scoped resources (such as PublishedResources) are located in namespace default.

Server rejected event (will not retry!)" err="events "published.resource.184f00cb7360fddb" is forbidden: User "system:serviceaccount:syncagent:exports-published.resource" cannot patch resource "events" in API group "" in the namespace "default"