fix(control-plane): use project kube client for namespace provisioner

When PROJECT_KUBE_TOKEN_FILE is set, the project kube client carries the
TSA identity (tenantaccess-ambient-control-plane) which already has
namespace-admin RoleBindings in ambient-code--config. The main in-cluster
SA does not have access to tenantnamespaces.tenant.paas.redhat.com.

Pass projectKube to buildNamespaceProvisioner when available so the MPP
TenantNamespace provisioner uses the TSA token rather than the pod SA token.

🤖 Generated with [Claude Code](https://claude.ai/code)

Co-Authored-By: Claude <noreply@anthropic.com>

Author: Ambient Code Bot

components/ambient-control-plane/cmd/ambient-control-plane/main.go

@@ -113,7 +113,11 @@ func runKubeMode(ctx context.Context, cfg *config.ControlPlaneConfig) error {
 		log.Info().Str("token_file", cfg.ProjectKubeTokenFile).Msg("using separate project kube client")
 	}
 
-	provisioner := buildNamespaceProvisioner(cfg, kube)
+	provisionerKube := kube
+	if projectKube != nil {
+		provisionerKube = projectKube
+	}
+	provisioner := buildNamespaceProvisioner(cfg, provisionerKube)
 	tokenProvider := buildTokenProvider(cfg, log.Logger)
 
 	factory := reconciler.NewSDKClientFactory(cfg.APIServerURL, tokenProvider, log.Logger)