Resources.WithNamespace mutates receiver, unsafe for concurrent use

## Problem

`Resources.WithNamespace()` mutates the receiver (`r.namespace = ns; return r`). The `client.Resources(namespace)` method calls `WithNamespace` on a shared `*Resources` instance. If two goroutines call `client.Resources("ns1")` and `client.Resources("ns2")` concurrently, they race on the `namespace` field.

This has existed since `WithNamespace` was introduced in 2021. The `deepCopyConfig()` fix in PR #396 works around it at the `env` layer by creating a fresh `klient.Client` per test, but direct usage of `klient.Client` outside of `env.Test()` is still affected.

## Related

- #352: `Config.Client()` race in parallel tests (fixed by #396 via `deepCopyConfig`)
- #258: Race in `Before/AfterEachTest` with `t.Parallel()` (fixed by #292)
- #216: Data races around `testing.T` and test context (fixed by #292)

These fixes addressed race conditions at the config and env layer. The `Resources.WithNamespace` mutation is the same pattern, one layer deeper.

Start at Resources.WithNamespace and client.Resources, then read how the shared *Resources instance is used outside env.Test(). Verify concurrent calls for different namespaces do not mutate shared state, and add or run a regression test with Go's race detector. Done means direct klient.Client usage is safe for concurrent namespace requests.

Written by the indexing model from the issue text.