ycb_VictoriaMetrics_c8a1beef46d71

what a new run launched now would send

Kubernetes service discovery already supports attaching node metadata to discovered targets via `attach_metadata.node` (and the global `-promscrape.kubernetes.attachNodeMetadataAll` flag). We need equivalent support for namespace metadata so operators can enrich scrape targets with the labels and annotations of the target's namespace.

Requirements (align with Prometheus `kubernetes_sd_configs` / issue #7486):
1. Add an `attach_metadata.namespace` boolean on kubernetes SD config. When true, attach namespace labels/annotations to discovered targets for roles: pod, service, endpoints, endpointslice, and ingress.
2. Add a global flag mirroring the node one (same naming/override pattern as attachNodeMetadataAll) that defaults `attach_metadata.namespace=true` for all kubernetes_sd_configs, still overridable per config.
3. When namespace metadata attachment is enabled, watch/list Namespace objects from the Kubernetes API (as needed for enrichment). Namespaces themselves are not scrape targets.
4. Expose the usual meta labels when attachment is on: `__meta_kubernetes_namespace_label_<name>`, `__meta_kubernetes_namespace_labelpresent_<name>`, `__meta_kubernetes_namespace_annotation_<name>`, `__meta_kubernetes_namespace_annotationpresent_<name>`.
5. Follow the existing node-metadata attachment path so label registration, caching/lookup, and per-config vs global flag precedence stay consistent.

Include unit coverage for namespace list parsing and for label attachment on the roles that already have target-label tests.

Interface contract — the change must expose exactly this surface:
YAML: AttachMetadata.Namespace (`namespace` bool). Flag: `-promscrape.kubernetes.attachNamespaceMetadataAll`. Meta label prefixes: `__meta_kubernetes_namespace_label_`, `__meta_kubernetes_namespace_labelpresent_`, `__meta_kubernetes_namespace_annotation_`, `__meta_kubernetes_namespace_annotationpresent_`. Same-package test surface: `Namespace` / `NamespaceList` types, `parseNamespaceList`, namespace object key `/{name}`, `getTargetLabels` on namespaces returns nil; groupWatcher must support role `"namespace"` object lookup used when attaching metadata.

Work only inside this repository checkout. Make the code change the task
describes, keeping the diff focused — no drive-by refactors.

When you are done, leave your changes committed or in the working tree;
they are collected automatically.

Stay on this snapshot checkout (`task/ycb_VictoriaMetrics_c8a1beef46d71`). Never checkout, pull, or rebase onto `main`. That branch is a README-only orphan.
Stay on this HEAD. Do not fetch another default branch. Push only on the Cursor-created `crazy-cursor/…` side branch from this HEAD.

Some past runs of this task were launched with a different prompt (the prompt template changed since, or those runs predate this benchmark's stored prompt). Each run persists the exact prompt it sent at launch — that per-launch record is the audit trail; this page shows only the current one.