✅ test(e2e): add namespace multi-tenant isolation and CLI integration tests (#394)

## Summary
- Add `TestE2ENamespaceMultiTenantLifecycle` class covering full
multi-tenant lifecycle: register namespaces, create entities, verify
data isolation, verify rate limiting isolation, verify config isolation,
soft-delete namespace, purge via GSI4, and confirm other namespaces are
unaffected
- Add `TestE2ENamespaceCLIWorkflow` class covering end-to-end CLI
namespace commands: deploy, register, list, show, entity set-limits with
`--namespace`, delete, orphans, recover, and cleanup
- Both test classes use LocalStack fixtures and validate that namespace
registry, `--namespace` flag, and per-namespace scoped repositories work
together correctly
- Clarify in `.claude/rules/testing.md` that xdist must stay enabled for
non-benchmark test runs

## Test plan
- [x] `uv run pytest tests/e2e/test_namespace.py -v` — 9/9 pass
(LocalStack)
- [x] `uv run pytest tests/unit/ -q` — 2349/2349 pass
- [x] `uv run pre-commit run --all-files` — all hooks pass
- [x] `uv run pytest tests/e2e/test_aws.py --run-aws -v` — 22 passed, 1
xfailed (real AWS)

Closes #373
Closes #363

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Author: sodre

.claude/rules/testing.md

@@ -85,7 +85,7 @@ zae-limiter local down
 
 Benchmarks detect performance regressions. Files in `tests/benchmark/` track latency, throughput, and DynamoDB capacity.
 
-**Important:** xdist must be disabled for benchmark timing to work. Override `addopts` from pyproject.toml:
+**Important:** `-o "addopts="` disables xdist by overriding `pyproject.toml`. Only use it for benchmarks and gevent tests — all other test runs (unit, integration, E2E) must keep xdist enabled for parallel execution:
 
 ```bash
 # Run benchmarks (disable xdist with -o "addopts=")