Rename back to catalogue-agent; stop owning the shared namespace

catalog-agent was one rename too aggressive: 'catalogue' is accepted, and the
Keycloak client, its audience scope and the Vault key that names it were never
renamed to match — leaving an inconsistency between what Kubernetes and
Keycloak call the same agent. Keycloak carries more weight to move, so this
side moves back.

k8s/namespace.yaml is out of this Kustomization's inventory. It was in
2026-08-31 when renaming the Kustomization pruned the old one — which owned
the namespace three agents share — and took all three down. A namespace shared
across repos should not be owned by any one of them.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

k8s/namespace.yaml

@@ -1,3 +1,11 @@
+# The `agents` namespace is shared by three agents from three repos.
+# Applied once, by hand, and deliberately NOT in this repo's Kustomization
+# inventory: a namespace owned by one repo's self-managing Kustomization gets
+# deleted — and every other agent in it with it — the moment that repo renames
+# its Kustomization or GitRepository, which prunes the old one. Learned the hard
+# way on 2026-08-31.
+#
+# kubectl apply -f k8s/namespace.yaml   # once, before anything else
 # One namespace for the whole agent estate rather than one per agent. The agents
 # share nothing but a trust boundary — no data, no storage, no service mesh
 # policy — and splitting them would multiply the CA ConfigMap and the