After talking with Engineering, I'm adding admin to demo-cat-role as a less hacky (but less secure) approach to let us deploy extensions