Allow Operations logs for explicit namespace

[linear-code]

Reason

The Operations workflow's logs action always derives namespace as ai-dev-env-{env}. It therefore reports success with no pods when diagnosing application namespaces such as creativetoolkits-dev, blocking incident response for Stripe webhook failures.

Scope

For the existing read-only logs operation, honor the already-validated resource_namespace input when provided; retain the derived namespace as the default. No secret resource access or arbitrary commands.

Acceptance

• logs can read an allowed app label in an explicit Kubernetes namespace.
• Empty namespace input keeps current behavior.
• Existing strict input validation and 100-line limit remain.
• CI and workflow validation pass.