[Al-assad]

What problem does this PR solve?

A shared Kubernetes environment needs separate Doris controllers for different teams while creating new namespaces dynamically. The existing --namespace option accepts only one namespace; two unfiltered global controllers would reconcile the same CRs.

Add optional --namespace-selector. Both DorisCluster and DorisDisaggregatedCluster reconciliations check live namespace labels before any resource work. Namespace label events enqueue existing CRs for adoption without a controller restart. Read failures stop reconciliation. Empty configuration preserves current behavior.

Selector mode requires the global read cache and disabled webhooks. The global cache retains explicit cross-namespace dependencies such as FDB ConfigMaps; this partitions reconciliation, not RBAC. Deploy groups in separate controller namespaces for independent leader-election Leases, and use disjoint selectors.

Release note

Support dynamically selected namespace groups through --namespace-selector and dorisOperator.namespaceSelector in Helm.

Check List (For Author)

• Unit Test
• Manual test: render the Helm Chart after substituting its existing release-version placeholders; verify selector, disabled webhook and namespace get/list/watch RBAC.
• Behavior changed:
  • Yes: only when the new selector is configured.
• Does this need documentation?
  • Yes: doc/namespace-selector.md is included.

Validation: go test ./pkg/controller/namespacescope ./cmd/operator ./pkg/controller -run 'TestNamespace|TestFDB' -count=1 passed. Tests cover group separation, namespace label changes, missing namespaces, malformed selectors and legacy behavior. No live environment was changed.

Related consumer work: https://github.com/selectdb/selectdb-qa/pull/6628 and https://github.com/selectdb/selectdb-manager/pull/1531.

Check List (For Reviewer who merge this PR)

• Confirm the release note
• Confirm test cases
• Confirm document
• Add branch pick label