Rename back to catalogue-agent; stop owning the shared namespace

catalog-agent was one rename too aggressive: 'catalogue' is accepted, and the
Keycloak client, its audience scope and the Vault key that names it were never
renamed to match — leaving an inconsistency between what Kubernetes and
Keycloak call the same agent. Keycloak carries more weight to move, so this
side moves back.

k8s/namespace.yaml is out of this Kustomization's inventory. It was in
2026-08-31 when renaming the Kustomization pruned the old one — which owned
the namespace three agents share — and took all three down. A namespace shared
across repos should not be owned by any one of them.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

k8s/ingress.yaml

@@ -27,12 +27,12 @@
 apiVersion: cert-manager.io/v1
 kind: Certificate
 metadata:
-  name: catalog-agent-tls
+  name: catalogue-agent-tls
   namespace: agents
 spec:
-  secretName: catalog-agent-tls
+  secretName: catalogue-agent-tls
   dnsNames:
-    - catalog-agent.sttlab.local
+    - catalogue-agent.sttlab.local
   issuerRef:
     name: sttlab-local-ca
     kind: ClusterIssuer
@@ -40,7 +40,7 @@ spec:
 apiVersion: networking.k8s.io/v1
 kind: Ingress
 metadata:
-  name: catalog-agent
+  name: catalogue-agent
   namespace: agents
   annotations:
     nginx.ingress.kubernetes.io/auth-url: http://keycloak.keycloak.svc.cluster.local:8080/realms/classic-models/protocol/openid-connect/userinfo
@@ -55,16 +55,16 @@ spec:
   ingressClassName: nginx
   tls:
     - hosts:
-        - catalog-agent.sttlab.local
-      secretName: catalog-agent-tls
+        - catalogue-agent.sttlab.local
+      secretName: catalogue-agent-tls
   rules:
-    - host: catalog-agent.sttlab.local
+    - host: catalogue-agent.sttlab.local
       http:
         paths:
           - path: /
             pathType: Prefix
             backend:
               service:
-                name: catalog-agent
+                name: catalogue-agent
                 port:
                   number: 8080