worker: create namespaces with helm, drop the kubectl binary

trivy took the worker image 39 -> 18 -> 5 findings across two version bumps, and
the last 5 (4x golang.org/x/net, 1x Go stdlib) live in kubectl v1.36.2 — the
newest kubectl that exists. No release clears them; upstream has not rebuilt
against the patched Go yet. Chasing the version further has no end.

kubectl was in that image for exactly one call: ensure_namespace before helm.
`helm upgrade --install --create-namespace` does the same thing, idempotently,
as part of the install it already runs. So the binary goes, and its vendored CVEs
go with it. read_secret had no callers.

Tradeoff recorded: the namespace no longer gets an svcforge.io/team label, since
--create-namespace makes a bare one. Nothing reads that label today.

services/worker/main.py

@@ -22,7 +22,6 @@ from services.worker.handlers import HANDLERS
 from svcforge_core import obs
 from svcforge_core.adapters.clock import SystemClock
 from svcforge_core.adapters.helm import HelmProvisioner
-from svcforge_core.adapters.k8s import KubectlClient
 from svcforge_core.adapters.notify import LogNotifier
 from svcforge_core.domain.catalog import load_catalog
 from svcforge_core.domain.models import Task, TaskKind
@@ -185,7 +184,6 @@ async def _amain() -> None:
         instances=InstanceRepo(pool),
         tasks=TaskRepo(pool),
         provisioner=HelmProvisioner(helm_bin=settings.helm_bin, timeout_s=int(settings.helm_timeout_s)),
-        namespaces=KubectlClient(kubectl_bin=settings.kubectl_bin),
         notifier=LogNotifier(),
         clock=SystemClock(),
         catalog=load_catalog(settings.catalog_path),