Add ai-lab sandbox namespace for Adi's AI feature testing
Shell-only namespace bundle mirroring ai-dev (namespace, regcred, cert-manager issuers, wildcard cert + hardened ingress skeleton). No Mongo/Redis; plaintext-base64 secrets matching existing ai-dev pattern. GitOps-synced by primary-agent once merged to main.