Vouched at: #420

Summary

when gateway start times out waiting for the openshell namespace, the error
message now checks for failed helm-install-* jobs in kube-system and surfaces
the actual Helm error and last 30 log lines instead of the generic "namespace not ready" message.

Related Issue

Fixes #211

Changes

• Add diagnose_helm_failure() in openshell-bootstrap/src/lib.rs that queries
  helm-install-* jobs in kube-system for failed pods and returns job conditions
  • last 30 log lines
• Wire into wait_for_namespace() final timeout branch
• Fix awk filter: status.failed stays <none> during backoff retry window;
  filter on != "0" instead of != "<none>" && != "0" to catch actively-failing jobs
• Add unit test helm_failure_hint_is_included_in_namespace_timeout_message

Testing

• mise run pre-commit passes
• Unit tests added/updated — 78/78 pass
• E2E tests added/updated (not applicable — error path only)
• Live-tested end-to-end: built a gateway image with corrupted serviceaccount.yaml,
  confirmed the Helm error appears in the terminal output on timeout

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)
• Architecture docs updated (not applicable)