apl chart ships an annotation-less 00-namespace.yaml, so helm cannot adopt a pre-existing namespace

[aweingarten]

Describe the bug:

The apl chart renders its namespace via a bare 00-namespace.yaml with no helm ownership metadata. When that namespace already exists — which is common, because bootstrap Terraform frequently must create it first to land CRDs, StorageClasses, or NetworkPolicies ahead of the operator — helm refuses to adopt it and the release collides.

To Reproduce

1. Pre-create the target namespace (e.g. via Terraform) before installing the apl chart.
2. helm install apl/apl ...
3. Install fails with an ownership conflict:

   Error: rendered manifests contain a resource that already exists.
   Unable to continue with install: Namespace "<ns>" ... exists and cannot be
   imported into the current release: invalid ownership metadata; ... missing key
   "app.kubernetes.io/managed-by"; missing key "meta.helm.sh/release-name" ...
   

Expected behavior:

Either add helm ownership metadata to the namespace manifest (app.kubernetes.io/managed-by: Helm, meta.helm.sh/release-name, meta.helm.sh/release-namespace) so a pre-existing namespace can be adopted, or gate namespace creation so integrators who create it out-of-band aren't blocked. Bootstrap ordering frequently requires the namespace to exist before the operator install.

Cluster(s): Linode / Akamai LKE-Enterprise.

Versions: apl-core 6.0.0 (00-namespace.yaml still annotation-less on the v6 line).

Additional context:

We manage the collision downstream in cluster-bootstrap Terraform; native helm-adoptable ownership metadata would remove the workaround entirely.

[aweingarten]

Opened #3468.

While implementing it I found the fix suggested in the description doesn't actually work: helm validates ownership against the live object, so adding meta.helm.sh/release-name etc. to 00-namespace.yaml cannot make an already-existing namespace adoptable — it would only stamp namespaces the chart created itself, which were never the problem.

So the PR takes the second option instead: installation.createNamespaces (default true, no behaviour change) to skip rendering the namespaces when an integrator creates them out-of-band. The values comment also documents the labels such a creator has to set, since the platform NetworkPolicies select namespaces by the name label.