fix(agent): deploy workloads into their own namespace, not the agent's

nullplatform/agent/locals.tf

@@ -78,7 +78,7 @@ locals {
     DNS_TYPE                = var.dns_type
     DOMAIN                  = var.domain
     USE_ACCOUNT_SLUG        = var.use_account_slug
-    K8S_NAMESPACE           = var.namespace
+    K8S_NAMESPACE           = var.workload_namespace
     SERVICE_TEMPLATE        = var.service_template != "" ? var.service_template : local.worker_templates.SERVICE_TEMPLATE
     INITIAL_INGRESS_PATH    = var.initial_ingress_path != "" ? var.initial_ingress_path : local.worker_templates.INITIAL_INGRESS_PATH
     BLUE_GREEN_INGRESS_PATH = var.blue_green_ingress_path != "" ? var.blue_green_ingress_path : local.worker_templates.BLUE_GREEN_INGRESS_PATH

nullplatform/agent/variables.tf

@@ -166,11 +166,17 @@ variable "worker" {
 
 # Kubernetes namespace where the nullplatform agent will run
 variable "namespace" {
-  description = "Kubernetes namespace where the nullplatform agent will run"
+  description = "Kubernetes namespace where the nullplatform agent itself runs. This is NOT where scopes deploy their workloads — see var.workload_namespace."
   type        = string
   default     = "nullplatform-tools"
 }
 
+variable "workload_namespace" {
+  description = "Kubernetes namespace scopes deploy their application pods into, handed to the k8s-scope workers as K8S_NAMESPACE. Defaults to the k8s scope's own default, which is what every pre-worker agent used."
+  type        = string
+  default     = "nullplatform"
+}
+
 variable "create_namespace" {
   description = "Create the namespace if it does not exist. Leave true unless another module already owns it: nullplatform/base declares the same namespace with Helm ownership metadata, so with no ordering edge between the two whichever applies second fails."
   type        = bool