feat(kubernetes): map workspaces to namespaces

[dhirajsb]

Summary

Allow the Kubernetes compute runtime to map logical OpenShell workspace names to pre-provisioned Kubernetes namespaces. A configured mapping is fail-closed, while an empty mapping preserves the existing single-namespace behavior.

Related Issue

Closes #2486

Changes

• Add and validate a workspace-to-namespace map in the Kubernetes compute configuration.
• Route sandbox create, get, list, delete, watch, and service-account token bootstrap operations through the resolved namespace.
• Deduplicate namespace-wide operations when multiple workspaces share a namespace.
• Expose the mapping through Helm values and command-line configuration.
• Document the mapping and add unit coverage for resolution, validation, multi-namespace lookup, and fail-closed behavior.

Testing

• mise run pre-commit passes
• Unit tests added/updated
• E2E tests added/updated (not applicable to this initial configuration-backed implementation)
• cargo test -p openshell-driver-kubernetes (147 tests)
• Kubernetes service-account authentication tests (22 tests)
• Helm lint, Helm unit tests (76 tests), and generated documentation checks

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)
• Architecture docs updated (if applicable)

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.