fix(substrate): limit Substrate views to watched namespaces

[danielle-mustillo]

Description

Lines	Added	Removed
Code	197	73
Tests	681	37
Generated	26	12
Docs	7	5

Problem

A kagent API user on a controller that watched some namespaces could read the Substrate data of other namespaces:

• A request for an unwatched atespace or namespace returned the actors, templates, workers and counts of that namespace.
• A request with an empty atespace returned the actors and templates of all namespaces.
• The "next page" token could hold the name of an actor or worker in an unwatched namespace.

Resolution

The controller now returns only the Substrate data of its watched namespaces:

• A request for an unwatched atespace or namespace now gets PermissionDenied.
• A request with an empty atespace now returns only the data of the watched namespaces, one page at a time.
• The "next page" token now names only data in the watched namespaces.

A controller that watches all namespaces works as before.

User Experience

A kagent API user on a controller that watches ns-a can now share one Substrate with other teams and read only the ns-a actors, templates and workers.

grpcurl -d '{"atespace":"ns-b"}' <controller> kagent.api.v1.SystemService/ListSubstrateActors
→ PermissionDenied

Changes

Request to a controller that watches ns-a	Before	After (new 🆕)
Actors, workers or summary for ns-b	ns-b data	PermissionDenied
Actors or summary with an empty atespace	Data of all namespaces	ns-a data only
Workers with an empty namespace	One Substrate page, filtered	All Substrate workers read, then only ns-a workers returned, in worker name order
"Next page" token	Substrate token, can name an ns-b row	kagent token, names only ns-a data
UI atespace filter placeholder	"All atespaces"	"All watched atespaces"

Upgrade note: an actor page token from a controller before this change, or a bad token, gets InvalidArgument. Reload the UI page, or send the API request without the token.

Limits

• A user who calls ate-api directly, without the controller, is not stopped by this change.
• Each actor page makes one Substrate call for each watched namespace.
• The workers view reads the workers of all namespaces on each request and filters them in kagent. It takes about 100 ms at 10k workers, until ate-api can filter workers by namespace.
• Possible upstream follow-ups: a namespace filter on ListWorkers, one list call for a set of atespaces, and per-row checks or authz enforcement in ate-api.