Support a list of namespaces to watch rather than one or all

What would you like added?

I want to be able to deploy a GitHub ARC in a Kubernetes cluster to watch a list of namespaces.

As a GitHub Administrator, my options today for deploying the GitHub Action Runner Controller are limited. Action Runner Controllers connect to a single GitHub instance target (Enterprise on-prem/AWS or GitHub.com), which makes sense. Many large enterprises have many instances of GHES and a GitHub EMU account.

The challenge with the ARC deployment is that within Kubernetes, a single ARC can either:

A. Watch ALL namespaces within the cluster
B. Watch a SINGLE namespace within the cluster

As an ARC administrator/engineer, this greatly limits my capabilities during deployment and management of the controller. The limitations in the two current deployment options are covered below.

Installing ARC to a single namespace

• All customers Action Runner Deployments connect to a single controller in a single namespace
• No native way to limit network connections between Action Runners in the same namespace
  • Utilization of Kyverno, Istio, OPA would solve this, but introduces additional complexity
  • Introduction of security controllers (see above) could introduce unexpected behaviors with ARC and or Action Runners
• Can install multiple instances of ARC to multiple namespaces
  • This increases compute resource requirements for multiple controllers in multiple namespaces
  • Increases operational burden

Installing ARC Cluster-Wide

• Requires one Kubernetes Cluster per GitHub instance target
  • 12 on-prem instances would require 12 Kubernetes Clusters
• More clusters to manage; higher operational burden on platform engineers

Why is this needed?

As an ARC administrator/engineer, I would want to deploy a fewer number of ARCs into a fewer number of clusters and provide a scope of namespaces to watch.

• Deploy ARCs to isolated namespaces
  • Example: wwwin-github-org-1, wwwin-github2-org-1, github-com-org-a, github-dmz1-org, etc
• Have each of the ARCs map to a list of namespaces each without overlap
  • Example 1: wwwin-github-org-1 watching namespaces wwwin-gh-org-1-group-a, wwwin-gh-org-1-group-b, and wwwin-gh-org-1-group-c
  • Example 2: github-com-org-1 watching namespaces github-com-org-1-group-a, github-com-org-2-group-a, and github-com-org-2-group-b

This would allow us to:

• Provide namespace isolation between customers for Enterprises/Orgs/Repos
• Limit the number of required Kubernetes Clusters to manage
• Control (and limit) the number of ARC deployments for us to manage
• Reduce our operational burden of ARC deployments

Additional context

Add any other context or screenshots about the feature request here.

Start by reviewing the controller's current single-namespace and cluster-wide watch configuration and the Kubernetes reconciliation entry points. Define how a list of namespaces is configured and validated, then verify that separate ARC instances can watch non-overlapping namespace sets while existing single-namespace and all-namespace behavior remains supported.