#1358 uat: add namespace isolation and shard resilience test coverage

Context

The namespace isolation fixes (core #1923, extension #130, #131, #133) and doctor datastores --repair shipped without corresponding UAT coverage. The existing UAT tests use the old namespace set + namespace migrate flow and pass namespace inside --config JSON rather than the new --namespace CLI flag. Five gaps need filling.

Gap 1: setup extension --namespace flag not tested

setupDatastoreWithNamespace in src/cli/helpers/datastore_backend.ts passes namespace inside the --config JSON object, not as --namespace on the CLI. The --namespace flag (shipped in core #1923) is the recommended path and has a different resolution priority (--namespace > config JSON > marker). It needs its own test.

Add a helper variant or update setupDatastoreWithNamespace to use:

["datastore", "setup", "extension", extensionName, "--namespace", namespace, "--config", JSON.stringify(config)]

And add a test that verifies: namespace appears in .swamp.yaml, initial pull is scoped, no namespace migrate needed.

Gap 2: Contamination prevention scenario not tested

The exact bug path from #1320/#1325 — Repo A pushes solo-layout data, Repo B connects with namespace to the same prefix, verify B does NOT absorb A's data. This was the most impactful bug (34,700 duplicated objects in production) and has no UAT coverage.

Test outline:

1. Repo A: setupDatastore (no namespace), generate data, push
2. Repo B: setupDatastoreWithNamespace on same prefix
3. Assert: Repo B's local cache has zero foreign files
4. Assert: S3/GCS objects under {namespace}/ contain only Repo B's data
5. Assert: Repo A's root data is untouched

Run for both S3 and GCS backends.

Gap 3: doctor datastores --repair not tested

The new --repair command (core + extension repairNamespaceContamination method) has no UAT coverage. Test outline:

1. Set up a contaminated state: Repo A pushes solo, Repo B connects with namespace, manually seed foreign objects under {ns}/{foreignNs}/ on S3/GCS
2. doctor datastores --json — verify contamination is detected
3. doctor datastores --repair --json — verify preview shows correct counts
4. doctor datastores --repair --confirm --json — verify cleanup completes
5. data query — verify data is now visible
6. Verify foreign objects deleted, own data intact

Gap 4: Shard v2 resilience not tested

The Cluster A fix (#1277/#1329) — readShard retry and assembleIndexFromShards error propagation — has no UAT coverage. Test outline:

1. Push data, migrate to v2 shards (datastore migrate-index)
2. Delete one shard object from S3/GCS (simulates transient unavailability)
3. Attempt push — verify it fails with a clear error (not silent v1 downgrade)
4. Verify _meta.json remains version 2
5. Restore the shard, push again — verify success

Gap 5: Solo-layout push skip not tested

The #1343 fix — namespaced push skips stale solo-layout files — has no UAT coverage. Test outline:

1. Set up namespaced repo, generate data
2. Seed stale solo-layout files at cache root (outside namespace dir)
3. sync --push — verify only namespaced files are pushed
4. Verify no solo-layout files appear on S3/GCS under the namespace

Affected files

• src/cli/helpers/datastore_backend.ts — setupDatastoreWithNamespace should support --namespace flag
• tests/cli/adversarial/namespace_isolation_test.ts — add gaps 2, 4, 5
• tests/cli/datastore/namespace/ — add gap 3 (repair tests)
• tests/cli/datastore/namespace/regressions_test.ts — add gap 1