Rename back to catalogue-agent; stop owning the shared namespace

catalog-agent was one rename too aggressive: 'catalogue' is accepted, and the
Keycloak client, its audience scope and the Vault key that names it were never
renamed to match — leaving an inconsistency between what Kubernetes and
Keycloak call the same agent. Keycloak carries more weight to move, so this
side moves back.

k8s/namespace.yaml is out of this Kustomization's inventory. It was in
2026-08-31 when renaming the Kustomization pruned the old one — which owned
the namespace three agents share — and took all three down. A namespace shared
across repos should not be owned by any one of them.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

README.md

@@ -129,7 +129,7 @@ running library:
   conversation history lives in the process, and so does a pending write waiting
   for approval. Moving either out is what would allow a second replica.
 - The Keycloak client is still named `classic-models-agent-catalogue` while the
-  Kubernetes objects say `catalog-agent`. Either is fine — pick one.
+  Kubernetes objects say `catalogue-agent`. Either is fine — pick one.
 
 Everything this section used to list is done: the Keycloak client exists, writes
 and the A2A call to the supply agent work, and `k8s/` deploys through Flux.