Add support to watchNamespace and namespace-scoped rbac for Temporal controller

[R1-lav]

Add support to watchNamespace

Summary

Adds the support to namespace-scoped deployment for the controller manager for environments where cluster wide permissions are not allowed.## Summary

This PR adds support for watching multiple namespaces in the controller via the --watch-namespace flag (or WATCH_NAMESPACE environment variable).

The flag now accepts a comma-separated list of namespaces, allowing the controller to operate in multi-namespace scoped mode.

How it works

• If --watch-namespace (or WATCH_NAMESPACE) is empty, the controller watches all namespaces (default behavior).
• If a single namespace is provided, the controller runs in single-namespace scoped mode.
• If multiple namespaces are provided as a comma-separated list, the controller configures the manager cache to watch only those namespaces.

Example:

--watch-namespace=ns1,ns2,ns3

Other changes

Support of ownNamespace in helm values to support creating roles and rolebinding instead of clusterrole and clusterrolebinding for namespace-scoped deployments

[CLAassistant]

All committers have signed the CLA.

[carlydf]

Thanks for this, I think namespace-scoped operation is a useful feature. Before we discuss implementation details, it would help to know which use case you're actually targeting:

1. Release namespace only: the controller always watches the same namespace it's deployed in (rbac.ownNamespace + watchNamespace both implicitly
   refer to the release namespace)
2. Single arbitrary namespace: the controller is deployed in namespace A but watches namespace B
3. Multiple arbitrary namespaces: watchNamespace: "ns1,ns2" with the controller in a third namespace

The reason this matters is that rbac.ownNamespace and watchNamespace are currently independent knobs, but their interaction has sharp edges depending on the answer:

• If the watched namespace(s) differ from the release namespace and rbac.ownNamespace: true, the controller SA has no RBAC in the namespaces it's actually watching. It will silently fail to act there.
• If watchNamespace: "ns1,ns2" with rbac.ownNamespace: true, a single Role in the release namespace can't cover ns1 or ns2 — you'd need a ClusterRole or separate Roles per namespace.

If the scenario you're trying to support is (1), the implementation could be simplified significantly and the two flags could be collapsed into one. If the answer is (2) or (3), the RBAC side needs more thought before we add tests or docs.