[BUG] Helm chart leader election Role and RoleBinding ignore leaderElection.namespace

### What happened?

In `charts/node-readiness-controller/templates/rbac.yaml`, the leader election `Role` and `RoleBinding` metadata.namespace is hardcoded to `{{ include "node-readiness-controller.namespace" . }}`.

`values.yaml` supports `leaderElection.namespace: ""` (documented as "Namespace for the leader election lease. Defaults to the release namespace when empty"), and `templates/deployment.yaml` passes `--leader-election-namespace={{ .Values.leaderElection.namespace }}`.

When a user sets `leaderElection.namespace: kube-system`, the controller manager requests a Lease in `kube-system`. However, the Role and RoleBinding giving access to leases were created in the release namespace instead of `kube-system`. The controller pod crashes on startup with:

```
coordination.k8s.io/leases is forbidden: User "system:serviceaccount:node-readiness-controller-system:node-readiness-controller" cannot get resource "leases" in API group "coordination.k8s.io" in the namespace "kube-system"
```

In addition, when `leaderElection.enabled: false`, `templates/rbac.yaml` still creates the leader election Role and RoleBinding even though `--leader-elect` is not passed to the manager.

### Steps to Reproduce

1. Render the Helm chart templates with `leaderElection.namespace` set to another namespace:
```bash
helm template test-nrc charts/node-readiness-controller \
--namespace test-ns \
--set leaderElection.namespace=kube-system \
-s templates/rbac.yaml
```
2. Check the namespace on the rendered Role and RoleBinding. They are rendered in `test-ns` instead of `kube-system`:
```yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
name: test-nrc-node-readiness-controller-leader-election-role
namespace: test-ns
```

### Expected Behavior

1. When `leaderElection.namespace` is specified, the leader election `Role` and `RoleBinding` should be created in `default (include "node-readiness-controller.namespace" .) .Values.leaderElection.namespace`, while the RoleBinding subject ServiceAccount remains in `{{ include "node-readiness-controller.namespace" . }}`.
2. When `leaderElection.enabled` is false, the leader election Role and RoleBinding should be omitted.

### Controller Version / Image Tag

main (commit ca2acdc)

### Kubernetes Version

Client Version: v1.32.0

### Controller Logs

```
leases.coordination.k8s.io is forbidden: User "system:serviceaccount:node-readiness-controller-system:node-readiness-controller" cannot get resource "leases" in API group "coordination.k8s.io" in the namespace "kube-system"
```

### Additional Environment Details

Can send a PR with the template fix and unit tests in `charts/node-readiness-controller/tests/rbac_test.yaml`.

### AI Tools Usage

- [x] AI tools were used (complete below)

### How They Were Used

Used Antigravity IDE to inspect helm templates, verify the rendered manifests locally with helm template and helm unittest, and draft the issue text.

Start with charts/node-readiness-controller/templates/rbac.yaml and compare its leader-election resources with values.yaml and templates/deployment.yaml. Use the reproduction helm template command, then run the checks in charts/node-readiness-controller/tests/rbac_test.yaml; done means the resources follow the configured leader-election namespace, preserve the ServiceAccount namespace, and are omitted when leader election is disabled.

Written by the indexing model from the issue text.