feat: v2 executor namespace-aware scope matching

[fseldow]

Summary

Currently stripNamespacePrefix (added in #2671) discards the [namespace] prefix from artifact references before executor scope matching. The namespace information is not used by the v2 executor at all.

Background

Gatekeeper constraint templates encode namespace into the image key: [default]registry:5000/notation:signed. The v2 executor strips this prefix to do scope matching, but throws away the namespace value.

In v1, namespace was used to select namespaced CRDs (NamespacedVerifier, NamespacedKeyManagementProvider, etc.). In v2, executors are cluster-scoped and namespace is ignored.

Proposal

1. Change stripNamespacePrefix to parseArtifactKey that returns (namespace, artifact) instead of just the stripped artifact
2. Pass namespace into matchExecutor for namespace-aware filtering
3. Support namespace-scoped Executor CRDs, allowing different executor configurations per namespace
4. Consider extending the key format to [namespace|executor]image for explicit executor selection (avoids O(N×M) when multiple constraint templates and executors target the same image)

Related

• fix: strip namespace prefix from artifact in executor scope matching #2671 — stripNamespacePrefix implementation
• v1→v2 migration: response field rename (isSuccess → succeeded) breaks constraint templates #2669 — v1→v2 response field compatibility (isSuccess → succeeded)