worker: create namespaces with helm, drop the kubectl binary

trivy took the worker image 39 -> 18 -> 5 findings across two version bumps, and
the last 5 (4x golang.org/x/net, 1x Go stdlib) live in kubectl v1.36.2 — the
newest kubectl that exists. No release clears them; upstream has not rebuilt
against the patched Go yet. Chasing the version further has no end.

kubectl was in that image for exactly one call: ensure_namespace before helm.
`helm upgrade --install --create-namespace` does the same thing, idempotently,
as part of the install it already runs. So the binary goes, and its vendored CVEs
go with it. read_secret had no callers.

Tradeoff recorded: the namespace no longer gets an svcforge.io/team label, since
--create-namespace makes a bare one. Nothing reads that label today.

services/worker/deps.py

@@ -8,7 +8,6 @@ run in milliseconds against a FakeProvisioner instead of needing a cluster.
 from __future__ import annotations
 
 from dataclasses import dataclass
-from typing import Protocol
 
 from svcforge_core.adapters.clock import Clock
 from svcforge_core.adapters.helm import Provisioner
@@ -20,20 +19,6 @@ from svcforge_core.repo.tasks import TaskRepo
 from svcforge_core.settings import Settings
 
 
-class NamespaceEnsurer(Protocol):
-    """The one thing the worker needs from kubectl.
-
-    Narrower than `KubectlClient` on purpose: the handler creates namespaces and does
-    nothing else with the cluster, so that is the whole interface. Satisfied by
-    `KubectlClient` in production and by a fake in tests, which is what keeps the worker
-    suite running in milliseconds with no cluster.
-    """
-
-    async def ensure_namespace(self, ns: str, labels: dict[str, str] | None = None) -> None:
-        """Create the namespace if absent. Idempotent — safe on every retry."""
-        ...
-
-
 @dataclass(frozen=True)
 class WorkerDeps:
     """Everything a handler is allowed to touch."""
@@ -42,10 +27,6 @@ class WorkerDeps:
     instances: InstanceRepo
     tasks: TaskRepo
     provisioner: Provisioner
-    # Creates the tenant namespace before helm is pointed at it. `helm --namespace X`
-    # does NOT create X, so without this the very first provision for a new team fails
-    # with "namespace not found" — the one path that is guaranteed untested by a fake.
-    namespaces: NamespaceEnsurer
     notifier: Notifier
     clock: Clock
     catalog: dict[str, CatalogEntry]