worker: create namespaces with helm, drop the kubectl binary

trivy took the worker image 39 -> 18 -> 5 findings across two version bumps, and
the last 5 (4x golang.org/x/net, 1x Go stdlib) live in kubectl v1.36.2 — the
newest kubectl that exists. No release clears them; upstream has not rebuilt
against the patched Go yet. Chasing the version further has no end.

kubectl was in that image for exactly one call: ensure_namespace before helm.
`helm upgrade --install --create-namespace` does the same thing, idempotently,
as part of the install it already runs. So the binary goes, and its vendored CVEs
go with it. read_secret had no callers.

Tradeoff recorded: the namespace no longer gets an svcforge.io/team label, since
--create-namespace makes a bare one. Nothing reads that label today.

services/worker/handlers.py

@@ -63,15 +63,6 @@ async def handle_provision(task: Task, deps: WorkerDeps) -> None:
     # below is idempotent either way, so this is bookkeeping, not a lock.
     await deps.instances.update_state(inst.id, InstanceState.REQUESTED, InstanceState.PROVISIONING)
 
-    # `helm --namespace X` does not create X. Every tenant's first provision lands in a
-    # namespace that does not exist yet, so this has to happen before helm runs or the
-    # install fails with "namespaces not found". Idempotent (kubectl apply of a Namespace
-    # manifest), so it costs one no-op API call on every subsequent provision.
-    await deps.namespaces.ensure_namespace(
-        inst.namespace,
-        labels={"svcforge.io/team": inst.team},
-    )
-
     await deps.provisioner.install(
         release=inst.release_name,
         ns=inst.namespace,