feat(tenants-test): configure --tenants and the tenant reconciler proof

[fiunchinho]

Closes #739

Problem

The slice 3 proof of agent-manager's tenant reconciler (giantswarm/agent-manager#71) and of tenants.organizations.enabled was done by hand on 2026-10-15. Nothing could run it again after a change to agent-manager, the chart or Substrate.

Change

• agentlab configure --tenants[=false] and platform.tenants.enabled in agentlab.yaml (needs platform.agents). The values render tenants.organizations.enabled: true. Until Inject credentials for agents in organization namespaces (credential provider policies by label) agent-platform#1041, they also render substrate.credentialProvider.namespacePolicies: the chart's two entries, plus the two tenants-test namespaces (each read by its own atespace and by ate-golden). Today's chart needs these entries; without them a turn in an organization namespace cannot read its model key. HACKS.md U33 records the removal.
• agentlab tenants-test [email email]: two namespaces org-agentlab-tenants-a and -b, labelled giantswarm.io/organization, one person bound to agent-platform:editor in each (default: the first two users outside platform-admins). It calls agent-manager's REST API (port-forward to the pod) as each person with their Dex token (audiences kubernetes and agent-platform). Steps 1 to 6 of proofs: tenants-test — the tenant reconciler over two organization namespaces #739. Step 5 skips the network-policy check when agent-manager copies no network policies, and the grants check when the credential policy has no ownNamespaceSelector entry; each skip prints its reason. Step 6 asserts only the end state (Tenant reconciler: deleting a tenant's last agent deletes the tenant's OCIRepository agent-manager#175). The run removes its namespaces at the start, at the end and after a failure.
• A lab without the switch, a chart that does not wire it, a missing agent-platform:editor, or a credential policy without the two namespaces fails before any write, with the fix.
• Docs: docs/agents.md "Organizations as tenants", docs/cli.md, CLAUDE.md.

Tests

• Unit tests: the reconciler flags and the expected object sets, the object diff, the credential policy coverage, the rendered values (on and off), the live grants check, the credential log reader, the admission refusal classifier, the default people.
• go test ./...: pass, except TestMeasureBuildNotAvailable and TestMeasureBuildDownloadsDependencies on macOS (BSD date +%N, not changed here). golangci-lint and pre-commit: pass.
• Live run: the result is added after the user runs it.

Review

id	severity	outcome	note
F1	blocking	fixed	the tenant WorkerPool's spec.replicas must equal --tenant-worker-pool-replicas; ready and Running counts equal
F2	non-blocking	rejected (reviewer accepted)	the #1041 helper keeps the values' policies and adds the selector entries, so the lab list does not remove them
F3	non-blocking	fixed	HACKS.md U33
F4	non-blocking	fixed	the hint names kubectl logs deploy/agent-manager
F5	non-blocking	fixed	the error says when the chart does not wire the switch
F6	non-blocking	fixed	agent-platform:editor checked before any write
F7	suggestion	fixed	a bare --multi-tenant reads as on
G1	suggestion	fixed	U33 wording