worker: create namespaces with helm, drop the kubectl binary

trivy took the worker image 39 -> 18 -> 5 findings across two version bumps, and
the last 5 (4x golang.org/x/net, 1x Go stdlib) live in kubectl v1.36.2 — the
newest kubectl that exists. No release clears them; upstream has not rebuilt
against the patched Go yet. Chasing the version further has no end.

kubectl was in that image for exactly one call: ensure_namespace before helm.
`helm upgrade --install --create-namespace` does the same thing, idempotently,
as part of the install it already runs. So the binary goes, and its vendored CVEs
go with it. read_secret had no callers.

Tradeoff recorded: the namespace no longer gets an svcforge.io/team label, since
--create-namespace makes a bare one. Nothing reads that label today.

libs/svcforge_core/svcforge_core/adapters/helm.py

@@ -199,6 +199,13 @@ class HelmProvisioner:
                 entry.chart,
                 "--namespace",
                 ns,
+                # `--namespace X` does not create X. Every tenant's first provision targets
+                # a namespace that does not exist yet, and helm fails with "namespaces not
+                # found". helm creates it here rather than a separate `kubectl apply` step,
+                # which keeps kubectl out of the worker image entirely — one fewer binary,
+                # and one fewer set of vendored Go CVEs to track. Idempotent: existing
+                # namespaces are left alone.
+                "--create-namespace",
                 "--version",
                 entry.chart_version,
                 "--values",