k8s: add base namespace and pod disruption budgets

- Namespace setup script with PSP/RBAC
- PodDisruptionBudgets for all services (zero-downtime drain)

k8s/base/namespace-setup.sh

@@ -0,0 +1,19 @@
+#!/bin/bash
+# Reusable namespace setup script
+# Creates namespace and applies pod-security policy labels
+# Usage: bash k8s/base/namespace-setup.sh <namespace> [<namespace2> ...]
+set -euo pipefail
+
+if [ $# -eq 0 ]; then
+  echo "Usage: $0 <namespace> [<namespace2> ...]" >&2
+  exit 1
+fi
+
+for namespace in "$@"; do
+  kubectl create namespace "$namespace" --dry-run=client -o yaml | kubectl apply -f -
+  kubectl label namespace "$namespace" \
+    pod-security.kubernetes.io/enforce=privileged \
+    pod-security.kubernetes.io/enforce-version=latest \
+    --overwrite
+  echo "✓ Namespace '$namespace' ready"
+done