Correct the fix: mark the namespace prune-disabled, don't drop it from inventory

Dropping it from resources: was the same accident by a different door — Flux
prunes anything that disappears from a Kustomization's rendered inventory, so
the live Kustomization's next reconcile would have deleted the namespace
itself. Caught before it fired by suspending that Kustomization.

kustomize.toolkit.fluxcd.io/prune: disabled on the object is the documented
way to keep Flux creating/updating a resource while never deleting it.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

k8s/kustomization.yaml

@@ -1,6 +1,7 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
+  - namespace.yaml
   - ca-configmap.yaml
   - externalsecret.yaml
   - configmap.yaml

k8s/namespace.yaml

@@ -1,11 +1,21 @@
-# The `agents` namespace is shared by three agents from three repos.
+# The `agents` namespace is shared by three agents from three repos. Kept in
-# Applied once, by hand, and deliberately NOT in this repo's Kustomization
+# this Kustomization's inventory — Flux must be able to *create* it on a first
-# inventory: a namespace owned by one repo's self-managing Kustomization gets
+# apply — but marked so Flux will never *prune* it.
-# deleted — and every other agent in it with it — the moment that repo renames
+#
-# its Kustomization or GitRepository, which prunes the old one. Learned the hard
+# Without the annotation below, deleting or renaming this repo's Kustomization
-# way on 2026-08-31.
+# (which is exactly what a rename like catalog-agent -> catalogue-agent does —
+# the old Kustomization object goes away) prunes everything in that
+# Kustomization's inventory, the Namespace included, taking every other agent
+# in it down too. Learned the hard way on 2026-08-31: removing the resource
+# from `resources:` looked like the fix and is actually the same accident by a
+# different door — the next reconcile of the *live* Kustomization sees the
+# object vanish from its rendered inventory and prunes it right then.
+#
+# kustomize.toolkit.fluxcd.io/prune: disabled is the documented way to opt one
+# resource out of pruning while Flux keeps managing (creating/updating) it.
 #
 # kubectl apply -f k8s/namespace.yaml   # once, before anything else
+#
 # One namespace for the whole agent estate rather than one per agent. The agents
 # share nothing but a trust boundary — no data, no storage, no service mesh
 # policy — and splitting them would multiply the CA ConfigMap and the
@@ -15,3 +25,5 @@ apiVersion: v1
 kind: Namespace
 metadata:
   name: agents
+  annotations:
+    kustomize.toolkit.fluxcd.io/prune: disabled