Namespace-scoped Pruner Execution & RBAC Reduction

Feature request

Feedback from @afrittoli based on observations in the dogfooding cluster.
It would be useful to allow the Tekton pruner to run in a namespaced mode. If a list of namespaces is provided, the pruner should only act on those namespaces and ignore all others.

When such a list is configured, the pruner should not list namespaces cluster-wide. This also means the service account would no longer need permission to list namespaces, since the scope is already known.

The existing behavior should remain unchanged when no namespace list is provided.

Use case

In shared or restricted clusters, teams often want the pruner to clean up Tekton resources only in specific namespaces (for example, CI namespaces). Today, the pruner requires cluster-wide access even when only a few namespaces need to be pruned. This makes it harder to follow the principle of least privilege and increases the overall access granted to the pruner.

A namespaced mode would make it easier to:

• Limit the pruner’s scope to the intended namespaces
• Reduce required RBAC permissions
• Run the pruner safely in multi-tenant or regulated environments

Start with the issue requirements for namespace-scoped pruning and the existing pruner configuration and RBAC behavior. Trace how configured namespaces are selected and how namespace listing permissions are used; done means configured namespaces are pruned without cluster-wide namespace listing, while empty configuration preserves current behavior.