metrics: label workload metrics by namespace

[zili-simular]

Summary

• add the Kubernetes namespace label to workload-attributable VM boot, snapshot save/push, peer restore, readiness probe, hibernate, and wake IP wait metrics
• expose tracked VM inventory per namespace, derive each gauge from provider-owned counts, and remove inactive namespace series
• keep snapshot pull duration node-scoped because create-path singleflight pulls can serve multiple namespaces
• document and test the resulting metric label contracts

This prepares the scrape pipeline to derive distinct staging and testing environment labels when both environments share a Cocoon cluster.

Related to https://github.com/simular-ai/ops/issues/40

Testing

• make test
• make fmt-check
• make lint

[CMGS]

Reviewed the PR stacked on current main (after #89) with the update.go hunk resolved as in the earlier comment: the stacked tree builds, go test -race ./... passes on all 9 packages, lint is clean on darwin and linux, and every WithLabelValues site for the six relabeled metrics passes the right arity (vm_table_size, vm_boot_duration_seconds, snapshot_save_duration_seconds, snapshot_push_duration_seconds, hibernate_total, wake_ip_wait_total — all call sites enumerated). The inline notes are the only things I would change: the two altitude items remove the new string parameters rather than thread them, the gauge note is about series lifetime, and the test file needs the shadowed testing renamed and its three inline comments dropped. Per-request cost of the change is zero on the probe and scrape paths; the label lookups fire once per VM bind and drop under p.mu.