deployment: Grant tools RO access to job status
This seems like an oversight, tools have access to entire jobs and
status subobjects of other objects. The read-only access is also
matching other status subobjects that tools already have access to.
Bug: T357172