fix: default operator watchNamespaces to release namespace

[devfreddy-langchain]

Problem

When watchNamespaces is unset (the default), the operator watches all namespaces cluster-wide. In multi-dataplane and shared cluster deployments, this causes unintended cross-namespace reconciliation (ref: support #18149).

Solution

Default WATCH_NAMESPACE to .Release.Namespace at the template level (since .Release.Namespace is not available in values.yaml). This makes cluster-wide watching an explicit opt-in rather than a silent default.

Changes

langgraph-dataplane:

• deployment.yaml: Chain defaults for WATCH_NAMESPACE: config.watchNamespaces > operator.watchNamespaces > .Release.Namespace
• rbac.yaml: Replace if/else structure with computed $effectiveWatchNamespaces variable; remove ClusterRole/ClusterRoleBinding fallback
• values.yaml: Add comments documenting default behavior and precedence

langsmith:

• deployment.yaml: Default WATCH_NAMESPACE to .Release.Namespace when operator.watchNamespaces is empty
• rbac.yaml: Same structural change as langgraph-dataplane; remove ClusterRole/ClusterRoleBinding fallback
• values.yaml: Add comment documenting default behavior

Breaking change: customers who never set watchNamespaces

	Before	After
Empty watchNamespaces	ClusterRole + ClusterRoleBinding (cluster-wide operator scope)	Role + RoleBinding scoped to .Release.Namespace only

Impact scenarios

1. Operator stops managing LGP resources in other namespaces. If a customer deployed LGP resources in namespaces other than the release namespace without explicitly configuring watchNamespaces, the operator will silently stop reconciling those resources after upgrade. Existing deployments won't be deleted, but they'll become unmanaged orphans.

2. Helm deletes the ClusterRole/ClusterRoleBinding on upgrade. Helm tracks managed resources and will remove ClusterRole/ClusterRoleBinding during helm upgrade since they no longer appear in the rendered templates. This is automatic and correct, but it's a meaningful permissions reduction that happens immediately.

3. No obvious failure signal. The operator won't crash; it'll just have a narrower watch scope. Customers might not notice until they try to create or update an LGP in another namespace and nothing happens.

Who is NOT affected

Customers who explicitly set watchNamespaces already had namespace-scoped Role/RoleBinding resources. No change in behavior or RBAC type for them.

Recommended mitigations

• Upgrade notes / CHANGELOG entry calling this out as a breaking change
• Migration path: customers currently relying on cluster-wide scope should set watchNamespaces to a comma-separated list of all namespaces they use before or during upgrade
• Consider whether a watchAllNamespaces: true escape hatch is worth adding back (re-enables the ClusterRole path explicitly)