feat: k5s-stack-namespaces hook

[blairham]

Adds a k5s-stack-namespaces hook: two sibling k5s lane overlays that declare the same namespace: are rejected.

Why

The failure is silent. A new lane starts as a copy of an existing one, and if its namespace: isn't changed with everything else, k5s up server-side-applies over the old lane's objects. Nothing errors — the pods go Ready and the rig runs a blend of two lanes' configuration. For a perf rig that means every number it reports was measured against a universe nobody described.

Design choices

• Uniqueness only, never a naming convention. A repo's lane names are its own business; pinning something like perf-rig-<lane> would be one repo's convention wearing an org hook's clothes.
• Files are read as written, not through k5s's extends: resolution. Two lanes that both restate a shared namespace is the collision; resolving first would hide it. An overlay declaring no namespace inherits the base stack's — the normal shape for a lane that only adjusts load — and is skipped.
• Compares every stack in the changed files' directories, not just the changed set. A collision is a property of the whole set, and the lane that already owned the namespace is usually not in the commit that collides with it. Comparing only staged files would pass every time the older file is untouched, i.e. always.
• A runtime namespaceSuffix: user does not remove the need for this — it separates people, but two lanes declaring the same base still collide for any one engineer.

Install guard

The hook-install CI job exists because service-yaml-check shipped uninstallable for months. A new language: python hook added outside that guard reintroduces exactly the gap it was built to close, so this wires the new hook into both steps and grows the fixture with sibling overlays carrying distinct namespaces — otherwise the try-repo run would pass on an empty file set without exercising the grouping path.

Release

Second commit bumps pyproject.toml to 0.5.0 (new hook = minor) and moves the four consumer-facing rev: examples plus the "Current release" line together. The version was also behind independently — it read 0.3.0 against a repo already tagged v0.4.0, the exact drift the Releasing section warns about, so this closes that on the way past. The worked example under Releasing stays at v0.4.0; it illustrates the procedure rather than pinning a release.

Verification

• 33 unit tests pass (7 new), including the collision-when-only-the-new-file-is-staged case and malformed-YAML-is-fatal.
• pip install of the package exposes k5s-stack-namespaces as a console script reporting 0.5.0, and it exits 0 on the CI fixture and 1 with a named-both-files error on a real collision.
• pre-commit try-repo could not be exercised locally — the Homebrew Caskroom pre-commit 4.6.2 build fails to resolve console scripts for the pre-existing service-yaml-check hook identically, so that path is left to CI, which installs upstream pre-commit via pip.