Create action-scoped namespace on KubernetesApi deploys

Summary

• KubernetesApi deploys to a not-yet-existing namespace failed with namespaces "<ns>" not found. The renderer never passed the action/step namespace into the kubectl-context builder, so ResolveNamespace fell back to the endpoint namespace (empty on most cloud targets) and the auto-create preamble in KubectlContext.sh was gated off — the first deploy to a fresh namespace never created it.
• Carry the resolved, already-expanded namespace on ScriptContext.Namespace and have the Api context builder prefer it, so the target namespace is created before kubectl apply. This matches the Agent transport, which already used intent.Namespace. Applies to every Api apply intent (containers, raw YAML, Helm, Kustomize) plus RunScript.
• Additive only: a new optional ScriptContext.Namespace, no interface or public-signature changes. When unset, the prior ActionProperties -> endpoint -> default resolution is preserved verbatim, so existing deploys are unaffected.

Test plan

• Unit — KubernetesApiIntentRendererTests: apply / Helm / Kustomize / RunScript thread the resolved namespace into ScriptContext; #{...} namespace templates are expanded before reaching the builder.
• Unit — KubernetesApiContextScriptBuilderTests: ScriptContext.Namespace drives the kubectl context + create-namespace on both bash and PowerShell; takes precedence over endpoint and ActionProperties; null / whitespace falls back to the prior resolution unchanged.
• E2E — KubernetesAgentNamespaceWrappingE2ETests: full pipeline (real renderer + context builder via ProcessAsync) renders create namespace "<ns>" for an action-scoped namespace when the endpoint has none.
• Regression: 1121 Kubernetes unit tests green; full solution builds with 0 errors. New tests verified against the exact branch content (base main + this fix only).

Note: this is pure rendering logic (no persistence), so the applicable tiers are Unit + pipeline E2E; there is no DB behaviour to cover at the integration tier.