feat: scoped multi-namespace mode (Role per namespace, no ClusterRole)

Add a third RBAC posture between watch-globally (ClusterRole) and single
namespace: give Reloader an explicit list of namespaces to watch. The chart
creates a namespace-scoped Role + RoleBinding in each listed namespace (no
ClusterRole), and one install covers them all.

Go:
- new --namespaces flag / options.Namespaces
- resolveWatchNamespaces() picks list -> KUBERNETES_NAMESPACE -> all
- controller creation loops over the watched namespaces
- namespaces-to-ignore is now only honored in global mode (watchGlobally=true);
  in single-namespace and scoped modes the watched set is already explicit

Helm:
- new reloader.namespaces value (active when watchGlobally=false); accepts either
  a YAML list or a comma-separated string for consistency with the sibling
  namespace options
- reloader-watchNamespaces helper (release ns always auto-included, deduped)
- shared reloader-namespaced-rules template reused per namespace
- role.yaml/rolebinding.yaml range over the list; deployment passes --namespaces
- --namespaces-to-ignore only rendered when watchGlobally=true
- fail guard for watchGlobally=true + namespaces set

Tests: unit test for resolveWatchNamespaces; scoped-namespaces e2e case.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

internal/pkg/cmd/reloader_test.go

@@ -0,0 +1,62 @@
+package cmd
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+)
+
+func TestResolveWatchNamespaces(t *testing.T) {
+	tests := []struct {
+		name                string
+		namespaces          []string
+		kubernetesNamespace string
+		wantNamespaces      []string
+		wantGlobal          bool
+	}{
+		{
+			name:                "scoped mode takes precedence over env",
+			namespaces:          []string{"team-a", "team-b"},
+			kubernetesNamespace: "reloader-system",
+			wantNamespaces:      []string{"team-a", "team-b"},
+			wantGlobal:          false,
+		},
+		{
+			name:                "scoped mode with single namespace",
+			namespaces:          []string{"team-a"},
+			kubernetesNamespace: "",
+			wantNamespaces:      []string{"team-a"},
+			wantGlobal:          false,
+		},
+		{
+			name:                "single namespace mode from env",
+			namespaces:          nil,
+			kubernetesNamespace: "reloader-system",
+			wantNamespaces:      []string{"reloader-system"},
+			wantGlobal:          false,
+		},
+		{
+			name:                "global mode when nothing set",
+			namespaces:          nil,
+			kubernetesNamespace: "",
+			wantNamespaces:      []string{v1.NamespaceAll},
+			wantGlobal:          true,
+		},
+		{
+			name:                "empty list falls back to env",
+			namespaces:          []string{},
+			kubernetesNamespace: "reloader-system",
+			wantNamespaces:      []string{"reloader-system"},
+			wantGlobal:          false,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			gotNamespaces, gotGlobal := resolveWatchNamespaces(tt.namespaces, tt.kubernetesNamespace)
+			assert.Equal(t, tt.wantNamespaces, gotNamespaces)
+			assert.Equal(t, tt.wantGlobal, gotGlobal)
+		})
+	}
+}