test: add workflow visibility tests for poimen-harness namespace

Verify that WorkflowAdapter provides visibility into terminated workflows
in the poimen-harness namespace. This ensures namespace pass-down feature
is working correctly and users can specify different domains/namespaces
via X-Service: workflow requests.

Tests added:
1. integration-test.sh: Added workflow visibility tests
   - List workflows in poimen-harness namespace
   - Verify terminated/completed workflows are visible
   - Validate namespace parameter requirement
   - Check auth enforcement

2. workflow-visibility-test.sh: NEW dedicated workflow test script
   - Tests WorkflowAdapter namespace pass-down
   - Verifies list, describe, and auth enforcement
   - Specific focus on poimen-harness namespace
   - Looks for 4 terminated workflows

3. task-workflow-visibility.yaml: NEW Tekton task
   - Runs workflow visibility tests against live gateway
   - Sidecar deployment pattern
   - Publishes result + summary + workflow-count metrics

4. pipeline-sse-optimization.yaml: Updated
   - Added workflow-visibility-tests stage (runs after integration-tests)
   - Updated report-results to include workflow test results
   - Full pipeline now: integration → workflow-visibility → load → report

5. kustomization.yaml: Updated
   - Added task-workflow-visibility.yaml
   - Added workflow-visibility-test-script ConfigMap

This ensures that the deprecated /workflows endpoint replacement correctly
supports multi-tenant access via namespace specification in request payload.

k8s/tekton/task-workflow-visibility.yaml

@@ -0,0 +1,84 @@
+apiVersion: tekton.dev/v1
+kind: Task
+metadata:
+  name: workflow-visibility-test
+  namespace: api
+  labels:
+    app: api-gateway
+    component: testing
+spec:
+  description: >
+    Test workflow visibility via WorkflowAdapter.
+    Verifies that the gateway provides visibility into terminated workflows
+    in the poimen-harness namespace via X-Service: workflow routing.
+    This ensures namespace pass-down is working correctly.
+  
+  params:
+  - name: image
+    type: string
+    description: "Container image to test (repo:tag)"
+  - name: gateway-port
+    type: string
+    default: "8080"
+  
+  results:
+  - name: result
+    type: string
+    description: "pass or fail"
+  - name: summary
+    type: string
+    description: "Test summary"
+  - name: workflow-count
+    type: string
+    description: "Number of workflows found in poimen-harness"
+  
+  sidecars:
+  - name: gateway
+    image: $(params.image)
+    env:
+    - name: LISTEN_ADDR
+      value: "0.0.0.0:$(params.gateway-port)"
+    - name: CONFIG_PATH
+      value: /etc/gateway/config.yaml
+    - name: LOG_LEVEL
+      value: info
+    - name: AUTH_CLIENT_SECRET
+      valueFrom:
+        secretKeyRef:
+          name: api-gw-client-secret
+          key: client-secret
+          optional: true
+    volumeMounts:
+    - name: gateway-config
+      mountPath: /etc/gateway
+      readOnly: true
+  
+  steps:
+  - name: run-workflow-visibility-test
+    image: curlimages/curl:8.13.0
+    env:
+    - name: GW
+      value: "http://localhost:$(params.gateway-port)"
+    - name: RESULTS_DIR
+      value: /tekton/results
+    command: ["sh", "/scripts/workflow-visibility-test.sh"]
+    volumeMounts:
+    - name: test-script
+      mountPath: /scripts
+      readOnly: true
+    computeResources:
+      requests:
+        cpu: 100m
+        memory: 64Mi
+      limits:
+        cpu: 200m
+        memory: 128Mi
+  
+  volumes:
+  - name: gateway-config
+    secret:
+      secretName: api-gateway-config
+  - name: test-script
+    configMap:
+      name: workflow-visibility-test-script
+      defaultMode: 0755