chore: scaffold benchmark workload namespace and RBAC

[amh1k]

Summary

Scaffold Helm infrastructure for future benchmark execution.

• Default workloads to the release namespace, with an optional custom namespace and opt-in creation.
• Add coordinator and runner ServiceAccounts, namespace-scoped RBAC, and coordinator environment variables.
• No benchmark Jobs or credential Secrets are created during installation. Runtime execution and Secret management remain follow-up work.

Behavior to note

• Chart-created workload namespaces are retained on uninstall via helm.sh/resource-policy: keep and require manual cleanup. Existing namespaces are not owned by the chart.
• Secret permissions cover the entire workload namespace. With the default shared namespace, the coordinator can also read or delete OpenEverest Secrets. RBAC cannot restrict access by ownership labels or name prefixes; a dedicated workload namespace separates these permissions.

Validation

• Helm lint passed.
• Render checks passed for default and custom namespaces.
• Confirmed both ServiceAccounts were installed in the local k3d cluster.

Closes #3.