Release project: dissolve a repoless project back to a plain namespace

[epheo]

The "no repo configured" dead end (e.g. portail-operator-system, an old install's label residue) had only a forward exit (Attach repo). This adds the way back, one verb with two paths:

• Tenancy declared in the platform repo stages a rewrite of namespaces/<ns>.yaml as a plain Namespace — the file deliberately stays (handing Argo a deletion would prune the namespace itself), only the project label and repo annotation go; the PR is the release. A declared file carrying more than its Namespace (a VM Network rides some) refuses the whole release rather than pruning tenant networking.
• Label residue (nothing in git describes it) is stripped imperatively under the caller's own token — cluster RBAC is the gate, no SA writes, no VM/disk/network touched.

Namespaces still running VMs reappear under Existing tenants, adoptable again; empty ones leave the inventory. UI: "Release project…" in the repoless project's context menu, behind a typed confirm that names both paths. Also: *-operator-system namespaces are no longer offered as adoptable — an operator's home is never a tenant.

New forge-free git helper (LookupOnBranch distinguishing absence from failure), cluster.ReleaseNamespace, POST /api/projects/{project}/release, fixture residue scenario + spec (46/46), changeset tests for the git/residue split and the multi-doc refusal.

Live validation on hetznet: pending — the plan is to release the real portail-operator-system residue.

🤖 Generated with Claude Code

https://claude.ai/code/session_01B2CJp2mhGv61yHsQQqstGP

[epheo]

Live on hetznet (rc.4): released the REAL residue — right-click on portail-operator-system → Release project → typed confirm → toast; the dotvirt.io/project label is gone from the namespace (verified via kubectl), the pod-security/kustomize labels untouched, and the project left the tree within a frame. Smoke 6/6 on the same build. Temp SA removed.