Run namespace creation as a post-install/post-upgrade Helm hook

[Summonair]

Summary

#892 intentionally kept namespace creation out of Helm's hook system because the schema job (server-job.yaml) uses pre-install,pre-upgrade hooks. Since all pre-install/pre-upgrade hooks run before any other resource is applied, making the namespace job a pre-hook too would deadlock: it needs the frontend service, which doesn't exist until after hooks succeed. So the namespace job was left as a plain Job, named with the chart version + release revision baked in to avoid the "Job spec is immutable" problem across upgrades.

That workaround has a couple of downsides:

• A new completed Job object is left behind on every install/upgrade (cleaned up only via ttlSecondsAfterFinished, not immediately).
• It's a plain resource, so Helm doesn't wait on it by default — namespace creation is fire-and-forget rather than something the release can be said to have completed.

post-install,post-upgrade hooks avoid the deadlock from #892 entirely, since they run on the other side of that boundary — after normal resources (including the frontend Deployment/Service) are already applied. This PR switches the namespace job to use them by default, mirroring the useHelmHooks toggle that already exists for the schema job:

• server.config.namespaces.useHelmHooks (default true) makes the job use helm.sh/hook: post-install,post-upgrade with before-hook-creation,hook-succeeded deletion, and a stable name (<release>-<chart>-namespace) instead of the version/revision-suffixed one.
• Setting it to false preserves the exact previous behavior (plain Job, versioned name), for Flux/Rancher/Terraform users the same way schema.useHelmHooks: false already works.

Test plan

• helm unittest charts/temporal — all 147 existing tests pass, plus new/updated tests for the namespace job (13 total in that suite) covering: default hook annotations, stable job name, useHelmHooks: false fallback (annotations absent, versioned name preserved).
• helm template sanity-checked against charts/temporal/ci/postgres-values.yaml for both useHelmHooks: true (default) and useHelmHooks: false, confirming output matches the intended behavior in each mode.
• CI's ct install against a kind cluster (existing coverage already exercises server.config.namespaces.create: true via ci/postgres-values.yaml).

[CLAassistant]

All committers have signed the CLA.

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}