Verify namespace approval during SDK generation for new packages

## Summary

Add a namespace approval check at SDK generation time to block generation for brand-new packages that lack namespace approval. This is a layered defense for TypeSpec projects that were merged before the namespace approval workflow was enforced on spec PRs.

## Context

The new [namespace approval workflow](https://github.com/Azure/azure-rest-api-specs/pull/44085) gates spec PRs going forward — any tspconfig.yaml namespace change requires architect sign-off before the PR can merge. However, it cannot retroactively block already-merged specs with placeholder or unapproved namespaces.

Adding a check at SDK generation time would catch these cases before SDK PRs are created with incorrect package names.

## Proposed Behavior

- During SDK generation, check if the target package is **brand new** (not an existing published package).
- If new, verify that the namespace has been approved (e.g., via the `namespace-approved` label on the originating spec PR, or a recorded approval artifact).
- If no approval exists, block SDK generation and guide the user to get namespace approval via the spec PR workflow.
- Existing/already-published packages should not be blocked.

## Why not block at release plan or release time?

A release plan can be created even without emitter config. SDK generation is the step that requires the package name from tspconfig.yaml, making it the right place to enforce this check.

## Related

- Namespace approval workflow PR: https://github.com/Azure/azure-rest-api-specs/pull/44085
- Discussion: https://github.com/AzureSDKPR/issues (placeholder namespace thread)

cc: @praveenkuttappan @lirenhe @raych1