fix(ci): use namespace-scoped kubeconfig check, guard empty pod name

- Replace 'kubectl get nodes' (cluster-scope, forbidden for ci-tekton-trigger SA)
  with 'kubectl get namespaces' (namespace-scoped, allowed)
- Guard canary cleanup against empty POD_NAME to prevent 'resource name may not be empty'

Fixes CI run #1023

.gitea/workflows/ci.yaml

@@ -67,7 +67,7 @@ jobs:
         run: |
           mkdir -p ~/.kube
           echo "${KUBECONFIG_B64}" | base64 -d > ~/.kube/config
-          kubectl get nodes --no-headers | head -1
+          kubectl get namespaces --no-headers | head -1
           echo '✓ kubeconfig works'
         env:
           KUBECONFIG_B64: ${{ secrets.KUBECONFIG_B64 }}
@@ -157,8 +157,12 @@ jobs:
         if: always() && github.event_name == 'push' && github.ref == 'refs/heads/main'
         run: |
           POD_NAME="${{ steps.canary.outputs.pod_name }}"
-          kubectl delete pod "${POD_NAME}" -n api --ignore-not-found || true
-          echo "✓ Canary pod removed"
+          if [ -n "${POD_NAME}" ]; then
+            kubectl delete pod "${POD_NAME}" -n api --ignore-not-found || true
+            echo "✓ Canary pod removed"
+          else
+            echo "⚠ No canary pod to clean up (name was empty)"
+          fi
 
       - name: Gate on test result
         if: github.event_name == 'push' && github.ref == 'refs/heads/main' && steps.tests.outputs.result != 'pass'