Normalize --namespace, validate namespace case, fix error messages/CRD text, stop echoing dockerconfigjson parse errors

[nikhilsagotiya]

What this PR does

A small set of robustness and message-quality fixes, split into four independent commits so they can be reviewed (or dropped) separately.

1. fix: normalize --namespace flag and validate namespace value is lowercase

Namespace names are RFC 1123 labels, so always lowercase, but two places used the operator-supplied value verbatim:

• --namespace flag (cmd/controller/main.go): the value is used as a controller-runtime cache key. A mixed-case value made the controller watch nothing and reconcile nothing, with no error reported. It is now lowercased and trimmed once, right after flag parsing (new normalizeNamespace helper plus a unit test). The shipped Deployment does not pass this flag, so this only affects manual or custom runs.

• package-bundle ytt config (config/package-bundle/config/deployment.yml): data.values.namespace was substituted straight into Namespace.metadata.name. A mixed-case value rendered fine and only failed later at apply time with an API-server validation error. The config now fails at render time with a clear message:
  Validation Error: namespace must be lowercase (RFC 1123 DNS label), got 'SecretGen-Sys'

  Valid (lowercase) values are unaffected: the default render is byte-identical to before.

2. fix(error-messages): correct grammar, quoting and wording in user-facing messages

Follow-up to the earlier error-message pass. Message text only; no logic or return values change.

• The status condition no longer leaks a Go identifier: Expected secret to have type=corev1.SecretTypeDockerConfigJson, but did not now reads Expected secret to have type 'kubernetes.io/dockerconfigjson', but it does not.
• PEM formatted block becomes a PEM-formatted block (certificate and private key).
• got err becomes got error; serviceaccount becomes service account.
• Consistent lowercase input resources, and consistent single-quote style in the SecretExport validation messages, which now name the actual spec fields.
• The token-refresh error reads token for service account 'ns/name' .... The token cache key itself is unchanged.
• CRD descriptions shown by kubectl explain: InputResource is references ... a identifying and dynamic valid are fixed in the Go comments and in crds.yml.
• Two hack scripts: non zero becomes non-zero with a clearer explanation, and the e2e note gets proper punctuation.

The tests that assert the old strings are updated.

3. fix(crds): strip unresolved "TODO" note from generated CRD descriptions

controller-gen copies the description of corev1.LocalObjectReference.Name verbatim, including an upstream TODO: Add other useful fields. apiVersion, kind, uid? note, which then shows up in kubectl explain for SecretTemplate status.secret and Certificate spec.caRef. hack/crd-overlay.yml now strips it so regenerating does not bring it back, and crds.yml gets the same change. I checked the overlay against the previous crds.yml: exactly those two description lines change.

4. fix(sharing): do not echo parser error when a dockerconfigjson secret is invalid

NewCombinedDockerConfigJSON put the raw json.Unmarshal error in its message. encoding/json syntax errors echo the offending input character, and this data holds registry credentials, so a secret that is not valid JSON could leak its first character into the returned error, which ends up in the resource status and the controller logs. It now returns data is not valid dockerconfigjson. Reconcile still fails the same way. A new test asserts that no part of unparseable input appears in the error.

Testing

• golangci-lint v2.12.2 (the version CI pins) with the repo config: 0 issues.
• hack/verify-no-dirty-files.sh (what CI runs first: go fmt, vendor, tidy, build, test compile, ytt render): passes and leaves the tree clean.
• go test ./pkg/... ./cmd/...: pass, also with GODEBUG=fips140=only for the generator, sharing and satoken packages.
• ytt: default render unchanged; a mixed-case namespace value is rejected with the message above.
• Not run locally: the e2e suite (hack/test-all.sh), since it needs minikube/kapp. I'm relying on the CI job for that.

Notes for reviewers

• config/package-bundle/config/crds.yml was edited by hand for four description lines (two typos, two TODO strips). Running hack/gen-crds.sh with the currently vendored controller-gen rewrites about 200 lines of that file (descriptions reflowed, some fields reordered). That mismatch already exists on develop and is not caused by this PR, and CI does not run the generator. It may be worth a separate PR that regenerates the CRDs.
• The namespace check only changes behavior for a value that could never have worked: it fails earlier, with a clearer message.

[joaopapereira]

Lgtm