test: provision Cloud namespace per CI run

[tconley1428]

Summary

• provision a unique Cloud namespace for each Cloud CI job
• configure it with a job-local mTLS CA and client certificate in aws-ca-central-1
• delete the namespace in an always-running cleanup step after creation is accepted

Validation

• python3 -m py_compile .github/scripts/cloud_namespace.py
• Ruby YAML parse of .github/workflows/ci.yml
• ruff check and format check for the helper

Notes

• The Cloud Operations API key must have account-level permission to create and delete namespaces. The test suite itself uses the generated mTLS credentials.