mecak8s: isolate Lease and scheduler domains between chart releases

[ChrisJBurns]

Problem

Chart releases in the same namespace share a Lease namespace and the fixed scheduler-election session ID. Lease object names are derived from session ID without an installation/release domain, while each release's ServiceAccount can update every Lease in the namespace.

The fixed scheduler key means two otherwise independent releases can elect a single scheduler between them. Shared Lease authority also increases blast radius and makes same-ID collisions cross-release concerns.

Evidence

• The chart passes only --session-lease-k8s-namespace=<release namespace>.
• internal/adapter/k8slease.objectName hashes only the session ID.
• engine/port.SchedulerLeaderLeaseID is fixed across deployments.
• The chart Role grants get, create, update, and delete on all namespace Leases.

Proposed direction

Add a stable installation-specific Lease domain/prefix and include it in both session and scheduler Lease keys. Until then, document and validate a dedicated-namespace/one-release constraint.

Acceptance criteria

• Two releases in one namespace and using different Redis stores elect independent schedulers.
• One release cannot accidentally acquire or renew another release's session Lease.
• Upgrade/restart preserves the release's stable domain.
• Migration behavior for existing Lease names is safe and documented.

[ChrisJBurns]

Marked as low priority as although this is technical an issue, its only relevant if someone installs mecak8s inside of the same namespace twice