chore(temporal): provision isolated document-intelligence namespaces

[Sam123ben]

Parent

Platform prerequisite for #46 and recognizer execution in #51.

Verified state

The shared Temporal cluster runs in Kubernetes namespace temporal-system, but this does not prove a Temporal namespace exists for document intelligence. The frontend image has no temporal or tctl admin CLI. The application ADR requires document-intelligence-<environment> and rejects default.

Required reviewed platform changes

• Reconcile explicit sandbox and production Temporal namespaces named document-intelligence-sandbox and document-intelligence-prod through the Temporal platform source of truth, not application startup or imperative creation.
• Set explicit namespace retention, operator/admin access, service-account access and audit ownership.
• Permit only document-intelligence workers to start/query/cancel their namespace workflows; deny default and cross-environment access.
• Wire the environment-specific namespace into reviewed GitOps workload configuration without credentials in Git.
• Provide a read-only qualification command/job that proves namespace identity, retention, workflow execution, cancellation, replay/versioning and history boundaries using synthetic data only.

Acceptance evidence

• Sandbox qualification starts and cancels a synthetic workflow in document-intelligence-sandbox; it cannot start in default or production.
• Production configuration is separately reviewed and has no live OCR workload until feat(ocr): wire accepted sources into a concrete page recognizer #51 and chore(platform): provision managed OCR fallback prerequisites #49 acceptance evidence passes.
• Temporal histories contain only bounded identifiers and workflow state, never document bytes, recognized text, object locators, signed URLs or secrets.

Non-goals

No namespace is created from application code. This issue does not authorize a production rollout, IAM mutation, secret change or processing production documents.

[Sam123ben]

Implementation is in tesserix/tesserix-k8s#965. It adds the two dedicated namespaces through the existing idempotent Temporal platform hook and limits Temporal frontend authorization to kora-doc-scanner and kora-doc-worker. Focused manifest tests and Helm rendering passed; no imperative namespace creation or workload rollout was performed.