[bevicted]

1. This fixes use of the victim namespace's cloud credential, but it does not prevent the controller from reading the cross-namespace Service CR. Some metadata may still be exposed. Fully blocking cross-namespace access would require validation or authorization around serviceNamespace.
2. Credential lookup retains the documented fallback behavior: management-namespace credentials, or the default namespace credential when no local credential exists. If "same namespace" must be enforced literally with no fallback, this patch is insufficient. Based on the existing account-context documentation, the intended rule appears to be "resolve credentials using the Binding namespace", including those fallbacks.

Test guards against regression.