fix(cli): uninstall everything kagent install creates

[iplay88keys]

Description

kagent uninstall now removes everything kagent install creates, and exits non-zero when a step fails. Before, it removed only the kagent and kagent-crds releases, fell back to deleting a hard-coded list of CRDs, and printed errors but exited 0.

Uninstall runs these steps in order, each Helm release with helm uninstall --wait:

Step	Removes	Notes
1	SandboxTemplates in every namespace	Deleted while the kagent controller still runs, so it clears their kagent.dev/sandbox-preparation finalizer.
2	kagent release	Includes the Substrate WorkerPool.
3	SandboxConfigs	Deleted while atecontroller still runs, so it clears their sandboxconfig.ate.dev/workerpool-protection finalizer.
4	substrate release
5	Bundled PostgreSQL, including its PVC and data	Only when deployment/kagent-postgresql exists in the kagent namespace.
6	substrate-podcert release
7	substrate-crds and kagent-crds releases	Deletes every resource of those kinds, such as agents and model configs.
8	ate.dev/api-access label on the kagent namespace
9	ate-system and podcertificate-controller-system namespaces	Holds the CA pools and other prerequisites install creates outside Helm.
10	Substrate's ClusterTrustBundles	The four bundles the pod-certificate controller and atecontroller publish, deleted by name after their controllers are gone.

Behavior

• If the kagent release exists only in a namespace other than --namespace, uninstall stops before deleting anything and names the namespace to pass.
• Each step skips what is already gone: a missing release prints a warning, missing objects are ignored, and a resource type whose CRD is gone is skipped. Rerunning uninstall finishes an interrupted one.
• Waits for finalizers time out after 5 minutes.
• The bundled database is always deleted. Removing the CRDs and the substrate release deletes the agents and the snapshot store its rows refer to, so there is no option to keep it.
• These stay:
  • the kagent namespace (uninstall prints the kubectl delete namespace command);
  • a database install did not deploy, such as one used with --skip-database-setup;
  • CRDs installed outside Helm.
• deleteCRDs and its hard-coded CRD list are removed. Install's error for kagent CRDs that exist outside Helm no longer suggests kagent uninstall.

Testing

• TestUninstallReversesInstall runs uninstall against fake helm and kubectl binaries and checks the exact command sequence for four cases: a bundled database, --skip-database-setup, a rerun after the CRDs and kagent namespace are gone, and a kagent release in another namespace.
• go vet ./core/cli/... and go test ./core/cli/internal/commands/.