worker: create namespaces with helm, drop the kubectl binary

trivy took the worker image 39 -> 18 -> 5 findings across two version bumps, and
the last 5 (4x golang.org/x/net, 1x Go stdlib) live in kubectl v1.36.2 — the
newest kubectl that exists. No release clears them; upstream has not rebuilt
against the patched Go yet. Chasing the version further has no end.

kubectl was in that image for exactly one call: ensure_namespace before helm.
`helm upgrade --install --create-namespace` does the same thing, idempotently,
as part of the install it already runs. So the binary goes, and its vendored CVEs
go with it. read_secret had no callers.

Tradeoff recorded: the namespace no longer gets an svcforge.io/team label, since
--create-namespace makes a bare one. Nothing reads that label today.

tests/integration/test_worker.py

@@ -41,21 +41,10 @@ def _settings(**over: object) -> Settings:
     return Settings(**base)  # type: ignore[arg-type]
 
 
-class FakeNamespaceEnsurer:
-    """Records the namespaces it was asked to create. Satisfies NamespaceEnsurer."""
-
-    def __init__(self) -> None:
-        self.ensured: list[str] = []
-
-    async def ensure_namespace(self, ns: str, labels: dict[str, str] | None = None) -> None:
-        self.ensured.append(ns)
-
-
 def _deps(
     pool: DictPool,
     prov: FakeProvisioner,
     notifier: FakeNotifier | None = None,
-    namespaces: FakeNamespaceEnsurer | None = None,
     **over: object,
 ) -> WorkerDeps:
     return WorkerDeps(
@@ -63,7 +52,6 @@ def _deps(
         instances=InstanceRepo(pool),
         tasks=TaskRepo(pool),
         provisioner=prov,
-        namespaces=namespaces or FakeNamespaceEnsurer(),
         notifier=notifier or FakeNotifier(),
         clock=SystemClock(),
         catalog=CATALOG,