worker: create namespaces with helm, drop the kubectl binary

trivy took the worker image 39 -> 18 -> 5 findings across two version bumps, and
the last 5 (4x golang.org/x/net, 1x Go stdlib) live in kubectl v1.36.2 — the
newest kubectl that exists. No release clears them; upstream has not rebuilt
against the patched Go yet. Chasing the version further has no end.

kubectl was in that image for exactly one call: ensure_namespace before helm.
`helm upgrade --install --create-namespace` does the same thing, idempotently,
as part of the install it already runs. So the binary goes, and its vendored CVEs
go with it. read_secret had no callers.

Tradeoff recorded: the namespace no longer gets an svcforge.io/team label, since
--create-namespace makes a bare one. Nothing reads that label today.

ARCHITECTURE.md

@@ -128,8 +128,7 @@ sequenceDiagram
     Note over W,P: every 5s, while a semaphore slot is free
     W->>P: UPDATE ... FOR UPDATE SKIP LOCKED
     P-->>W: task (attempts now 1, locked_by=me)
-    W->>K: kubectl apply namespace (idempotent)
-    W->>K: helm upgrade --install --wait
+    W->>K: helm upgrade --install --create-namespace --wait
     K-->>W: release ready
     W->>P: CAS provisioning -> ready, set endpoint
     W->>P: complete(task, worker_id)