Feature: three-level permissions (Cluster Admin → Tenant → Subtenant)

Summary

Support a three-level permission hierarchy in Capsule:

Cluster Admin  →  Tenant Owner  →  Subtenant Owner

Today Capsule has two effective tiers: cluster administrators and tenant owners. There is no way for a tenant owner to delegate a bounded portion of their tenant to a sub-team without involving a cluster admin.

Problem / Use case

Larger tenants (e.g. a business unit) need to hand a subset of their tenant to sub-teams (squads, projects, environments) so those sub-teams can self-serve without getting full tenant-owner power and without cluster-admin intervention.

There is currently no first-class concept for this nested, self-service delegation.

What I want

A Subtenant tier owned by a Tenant Owner, where:

• A tenant owner can create/manage subtenants under their own tenant (no cluster admin needed).
• A subtenant owner gets only a bounded slice of the parent tenant — a subset of namespaces, resource/namespace quota, and RBAC.
• A subtenant's authority is always a subset of the parent's — it can never exceed or escalate above the parent tenant.
• Deleting/limiting the parent tenant cascades correctly to its subtenants.

Out of scope for this issue

Implementation/design details (API shape, controllers, webhooks) — this issue is only to capture the feature requirement. Happy to discuss the approach separately.

No files, tests, or entry points are named. Start by reviewing Capsule's existing tenant-owner and cluster-admin permission model, then inspect how Kubernetes RBAC, namespaces, and quotas are represented. Done requires an agreed design for bounded subtenant delegation, parent-child enforcement, and cascading limits before implementation can begin.