feat: queue-operator auto-registers Temporal namespace before creating TemporalWorker

A Queue's temporal.io/namespace label was trusted as-is -- if the referenced
Temporal namespace was never registered (or typo'd), the failure only
surfaced as a worker pod silently polling a namespace that doesn't exist.
Now reconcileTemporalWorker calls RegisterNamespace (idempotent, ignores
AlreadyExists) via a direct WorkflowService gRPC client before creating the
TemporalWorker, so namespace and worker always come into existence together.

Also grant queue-operator's ClusterRole create/delete on temporalworkers
(previously missing, causing forbidden errors on the create-then-delete path).

internal/operator/temporal_namespace.go

@@ -0,0 +1,14 @@
+package operator
+
+import "context"
+
+// TemporalNamespaceRegisterer registers a Temporal namespace. reconcileTemporalWorker
+// calls this before creating a TemporalWorker so a Queue's temporal.io/namespace
+// label always has a real namespace behind it — previously that label was
+// trusted as-is, and a typo'd or never-registered namespace would only
+// surface as a silently-stuck worker pod polling a namespace that doesn't
+// exist.
+type TemporalNamespaceRegisterer interface {
+	// RegisterNamespace registers namespace, treating AlreadyExists as success.
+	RegisterNamespace(ctx context.Context, namespace string) error
+}