Sub-manifests declare their own namespace; the root no longer needs to
force ci, and removing it keeps cluster-scoped resources clean.

Lets the autoapply SA manage cluster-scoped resources too, not just
those in the ci namespace.

Tack's fallback autoapply-yaml pipeline runs as system:serviceaccount:ci:default
before xeiaso-net-alrest-autoapply exists on the cluster, so the initial apply
can't create its own SA/Role/RoleBinding. Adding default as a second subject
breaks the chicken-and-egg.