feat: queue-operator auto-registers Temporal namespace before creating TemporalWorker

A Queue's temporal.io/namespace label was trusted as-is -- if the referenced
Temporal namespace was never registered (or typo'd), the failure only
surfaced as a worker pod silently polling a namespace that doesn't exist.
Now reconcileTemporalWorker calls RegisterNamespace (idempotent, ignores
AlreadyExists) via a direct WorkflowService gRPC client before creating the
TemporalWorker, so namespace and worker always come into existence together.

Also grant queue-operator's ClusterRole create/delete on temporalworkers
(previously missing, causing forbidden errors on the create-then-delete path).

internal/operator/fake_temporal.go

@@ -0,0 +1,41 @@
+package operator
+
+import (
+	"context"
+	"sync"
+)
+
+// fakeTemporal is an in-memory TemporalNamespaceRegisterer for reconciler
+// tests — avoids needing a real Temporal frontend just to exercise reconcile
+// logic.
+type fakeTemporal struct {
+	mu         sync.Mutex
+	registered map[string]int
+	err        error
+}
+
+func newFakeTemporal() *fakeTemporal {
+	return &fakeTemporal{registered: map[string]int{}}
+}
+
+func (f *fakeTemporal) RegisterNamespace(_ context.Context, namespace string) error {
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	if f.err != nil {
+		return f.err
+	}
+	f.registered[namespace]++
+	return nil
+}
+
+func (f *fakeTemporal) setErr(err error) {
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	f.err = err
+}
+
+func (f *fakeTemporal) count(namespace string) int {
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	return f.registered[namespace]
+}