worker: create namespaces with helm, drop the kubectl binary

trivy took the worker image 39 -> 18 -> 5 findings across two version bumps, and
the last 5 (4x golang.org/x/net, 1x Go stdlib) live in kubectl v1.36.2 — the
newest kubectl that exists. No release clears them; upstream has not rebuilt
against the patched Go yet. Chasing the version further has no end.

kubectl was in that image for exactly one call: ensure_namespace before helm.
`helm upgrade --install --create-namespace` does the same thing, idempotently,
as part of the install it already runs. So the binary goes, and its vendored CVEs
go with it. read_secret had no callers.

Tradeoff recorded: the namespace no longer gets an svcforge.io/team label, since
--create-namespace makes a bare one. Nothing reads that label today.

services/worker/Dockerfile

@@ -3,7 +3,7 @@
 # svcforge worker. Build from the REPO ROOT:
 #     docker buildx build -f services/worker/Dockerfile -t svcforge/worker:dev .
 #
-# The only service that shells out to helm/kubectl, so the only one carrying those two
+# The only service that shells out to helm, so the only one carrying that binary
 # binaries. They are copied from pinned images rather than curl'd, so the version is a
 # reviewable line in a Dockerfile instead of a network call at build time.
 
@@ -46,21 +46,6 @@ COPY --from=builder --chown=10001:10001 /app /app
 # (spdystream, fixed in 0.5.1) — trivy fails the build on them and is right to.
 # Deliberately 3.x: helm 4 is a breaking change and is not a CVE fix.
 COPY --from=alpine/helm:3.21.3@sha256:35da09ba0716fc7c3cd63b6b31ee380a9c7662e95f29ab0e4ae962420afd315b /usr/bin/helm /usr/local/bin/helm
-# kubectl 1.36.2 from the OFFICIAL registry.k8s.io image, replacing
-# bitnamilegacy/kubectl:1.31.2. Two reasons, either sufficient:
-#   - CVEs: the bitnami image is Go 1.22.9 and ships containerd < 1.7.29 (HIGH
-#     CVE-2024-25621) along with the same crypto/tls and grpc CRITICALs as helm above.
-#   - Skew: the target cluster runs v1.35.3. 1.31.2 is four minors behind, well outside
-#     kubectl's supported +/-1 window, so it was unsupported against this cluster.
-# bitnamilegacy publishes no 1.35 tag. registry.k8s.io/kubectl is the upstream-maintained
-# image, is a manifest list with linux/arm64 (this cluster is Ampere), and puts the binary
-# at /bin/kubectl rather than bitnami's /opt/bitnami path.
-#
-# 1.36.2 rather than 1.36.x-matching-the-cluster: k8s v1.35.x vendors
-# github.com/moby/spdystream v0.5.0, which carries CVE-2026-35469 (HIGH, fixed in
-# 0.5.1). v1.36.2 vendors 0.5.1. trivy blocks the release on it, correctly. One
-# minor ahead of the v1.35.3 API server is inside kubectl's supported +/-1 window.
-COPY --from=registry.k8s.io/kubectl:v1.36.2@sha256:b0d792e0d8dfb9bb1b922b78b23137e2a34bb6f9667640353a9d2aadd1fd7761 /bin/kubectl /usr/local/bin/kubectl
 
 ENV PATH="/app/.venv/bin:$PATH" \
     PYTHONUNBUFFERED=1 \