test(e2e): use test namespace in CM-786 IstioCSR gRPC CSR SPIFFE URI

The multi-operand suite runs IstioCSR in multi-operand-istio, not
istio-system. Build the SPIFFE ID from the actual namespace so grpcurl
can obtain a certificate instead of retrying until timeout.

Co-authored-by: Cursor <cursoragent@cursor.com>

Author: arun717

test/e2e/multiple_operands_test.go

@@ -714,7 +714,7 @@ func runCM786IstioCSRGRPCCertificateTest(ctx context.Context, clientset *kuberne
 		_ = clientset.CoreV1().ConfigMaps(ns.Name).Delete(ctx, "proto-cm", metav1.DeleteOptions{})
 	})
 
-	csr := generateCM786CSR()
+	csr := generateCM786CSR(ns.Name)
 	loader.CreateFromFile(AssetFunc(testassets.ReadFile).WithTemplateValues(
 		IstioCSRGRPCurlJobConfig{
 			CertificateSigningRequest: csr,
@@ -784,15 +784,15 @@ func runCM786ServiceMeshIstioCSRIntegrationTest(ctx context.Context, clientset *
 	}, lowTimeout, fastPollInterval).Should(Succeed())
 }
 
-func generateCM786CSR() string {
+func generateCM786CSR(istioNamespace string) string {
 	csrTemplate := &x509.CertificateRequest{
 		Subject: pkix.Name{
 			Organization:       []string{"CM-786"},
 			OrganizationalUnit: []string{"cert-manager-operator-e2e"},
 			Country:            []string{"US"},
 		},
 		URIs: []*url.URL{
-			{Scheme: "spiffe", Host: "cluster.local", Path: "/ns/istio-system/sa/cert-manager-istio-csr"},
+			{Scheme: "spiffe", Host: "cluster.local", Path: fmt.Sprintf("/ns/%s/sa/cert-manager-istio-csr", istioNamespace)},
 		},
 		SignatureAlgorithm: x509.SHA256WithRSA,
 	}