Rename back to catalogue-agent; stop owning the shared namespace

catalog-agent was one rename too aggressive: 'catalogue' is accepted, and the
Keycloak client, its audience scope and the Vault key that names it were never
renamed to match — leaving an inconsistency between what Kubernetes and
Keycloak call the same agent. Keycloak carries more weight to move, so this
side moves back.

k8s/namespace.yaml is out of this Kustomization's inventory. It was in
2026-08-31 when renaming the Kustomization pruned the old one — which owned
the namespace three agents share — and took all three down. A namespace shared
across repos should not be owned by any one of them.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

k8s/deployment.yaml

@@ -1,7 +1,7 @@
 apiVersion: apps/v1
 kind: Deployment
 metadata:
-  name: catalog-agent
+  name: catalogue-agent
   namespace: agents
 spec:
   # One replica, and that is a constraint rather than a default. Conversation
@@ -12,11 +12,11 @@ spec:
   replicas: 1
   selector:
     matchLabels:
-      app: catalog-agent
+      app: catalogue-agent
   template:
     metadata:
       labels:
-        app: catalog-agent
+        app: catalogue-agent
     spec:
       securityContext:
         runAsNonRoot: true
@@ -36,9 +36,9 @@ spec:
               containerPort: 8080
           envFrom:
             - configMapRef:
-                name: catalog-agent-config
+                name: catalogue-agent-config
             - secretRef:
-                name: catalog-agent-secrets
+                name: catalogue-agent-secrets
           volumeMounts:
             - name: sttlab-ca
               mountPath: /etc/sttlab-ca