fix: scope SpinAppExecutor finalizer check to executor's namespace

[melderan]

Summary

Fixes #480 — the handleDeletion() finalizer check for dependent SpinApps matches by executor name across all namespaces instead of scoping to the executor's own namespace. A SpinApp in namespace B blocks deletion of an unrelated SpinAppExecutor with the same name in namespace A.

Changes

One-line fix in internal/controller/spinappexecutor_controller.go:

// Before (matches all namespaces):
r.Client.List(ctx, &spinApps, client.MatchingFields{spinAppExecutorKey: executor.Name})

// After (scoped to executor's namespace):
r.Client.List(ctx, &spinApps, client.InNamespace(executor.Namespace), client.MatchingFields{spinAppExecutorKey: executor.Name})

Regression test (TestSpinAppExecutorReconcile_CrossNamespaceDoesNotBlockDeletion):

• Creates same-named executors in two namespaces
• Creates a SpinApp in namespace B only
• Deletes executor in namespace A
• Asserts it deletes successfully (was blocked before the fix)
• Asserts executor in namespace B is unaffected

Verification

Reproduced the bug on K8s 1.33.6 with spin-operator v0.6.1:

1. Created two namespaces with same-named executors, SpinApp only in ns-b
2. Deleted executor in ns-a → stuck with finalizer, operator logs "cannot delete SpinAppExecutor with dependent SpinApps"
3. Built and deployed the patched operator
4. Repeated the test → executor in ns-a deletes immediately, SpinApp in ns-b unaffected