Add managed-by labels to roxie-created namespaces

[AlexVulaj]

What

Labels all roxie-created namespaces with app.kubernetes.io/managed-by: roxie.

Why

This is phase 1 of improving teardown UX. Currently, users must remember which flags they used during deployment and specify the same flags during teardown. Without them, teardown silently skips with "Namespace doesn't exist.

Adding these labels enables future auto-detection of roxie-managed namespaces during teardown, so users won't need to remember/specify flags.

Changes

• Labels are added to both new and pre-existing namespaces (using --overwrite)
• Uses Kubernetes-recommended label convention (app.kubernetes.io/managed-by)

Testing

Dual-namespace mode (default):

make
./roxie deploy
kubectl get namespace -l app.kubernetes.io/managed-by=roxie
# Verified: acs-central and acs-sensor both labeled
./roxie teardown

Single-namespace mode:

./roxie deploy --single-namespace
kubectl get namespace -l app.kubernetes.io/managed-by=roxie
# Verified: stackrox namespace labeled
./roxie teardown --single-namespace

[mclasmeier]

I think adding managed-by labels is generally a good practice, so let's do that. It is not 100% clear to me how exactly this will help us with teardown-flow selection, but lets see.

I do have one suggestion though, which will allow us to implement a different feature later:

How about we not label existing namespaces, but only those which are really created by roxie? This would, as a follow-up, allow us to implement a safety check later (#19): Before modifying any resources in a namespace (I am specifically having the standard namespace stackrox with a teardown scenario in mind here), check if this label exists and if it does not, terminate with an error instead of happily modifying the cluster.

This could serve as a safety measure where we prevent accidental modifications of the wrong cluster.

[AlexVulaj]

@mclasmeier I like that approach - only label what we actually create. That'll make the teardown logic obvious (label = delete namespace, no label = delete resources only) and sets us up for the safety check later.

I'll update this PR to only add labels on namespace creation - appreciate the guidance!

[mclasmeier]

Thank you!