Ignore namespaceSelector when not watch globally

[yo-ga]

Root cause

Kubernetes Namespace is a cluster-scoped resource, not a namespaced one. As such, it cannot be managed via Role, which only applies to namespaced resources. To perform operations on Namespace (e.g., get, list), you must use a ClusterRole with a ClusterRoleBinding. Using a Role alone will not grant any permission on namespaces—including read/search access.

Issue list

Fixes #862 Fixes #893