Cross-namespace Backup restores need correct namespace and authorization

[leon-ape]

Problem

Generated Restore objects can use the target Cluster namespace instead of the referenced Backup namespace. This can fail to find the Backup or select a same-name Backup in the wrong namespace.

DataProtection also reads cross-namespace Backups without an explicit authorization check. Cross-namespace VolumeSnapshot restore is not valid because Kubernetes snapshot data-source references are namespace-scoped.

Expected behavior

• Generated Restores preserve the source Backup namespace.
• A Gateway API ReferenceGrant in the Backup namespace authorizes cross-namespace Restore references before the Backup is read.
• Cross-namespace VolumeSnapshot restore is rejected before PVC creation.

Affected releases

The same namespace and authorization gap exists in main, release-1.1, and release-1.0.