feat(k8s): map workspaces to operator namespaces

[dhirajsb]

Summary

Adds an optional explicit workspace-to-namespace map for Kubernetes operator mode.

This is stacked on NVIDIA#2656. Kubernetes platform operators commonly manage namespace names through cluster-specific conventions such as ownership prefixes, tenancy boundaries, or policy domains. Requiring a workspace identifier to equal the namespace name couples an application-facing identifier to cluster administration. An explicit map keeps those concerns independent while preserving the existing one-to-one behavior for label- and file-based namespace discovery.

Related Issue

• Addresses the namespace-decoupling requirement in feat(kubernetes): map workspaces to sandbox namespaces NVIDIA/OpenShell#2486
• Depends on feat(k8s): add namespace-per-workspace support (RFC 0011 Phase 3) NVIDIA/OpenShell#2656

Changes

• Add operator_workspace_namespaces to the Kubernetes compute driver.
• Resolve mapped namespaces through the existing operator allowlist and fail closed for unmapped workspaces.
• Use the same mapping for Kubernetes Secrets credential placement.
• Expose the map through the existing Helm chart and document it.

Testing

• cargo test -p openshell-driver-kubernetes -p openshell-driver-kubernetes-secrets
• cargo clippy -p openshell-driver-kubernetes -p openshell-driver-kubernetes-secrets --all-targets -- -D warnings
• helm unittest deploy/helm/openshell -f 'tests/*_test.yaml'
• helm lint deploy/helm/openshell
• Helm documentation generation check
• SPDX license header check

Checklist

• Tests added for mapped and unmapped workspaces
• Helm rendering covered by unit tests
• Configuration and architecture documentation updated
• Commit signed off