ate-env manifest: label the namespace so ate-env-api is admitted by Substrate's ingress policy

[Vicente Ferrara (vicentefb)]

Since substrate #2522, ate-system denies ingress by default and admits in-cluster API clients only from namespaces labeled ate.dev/api-access=true. The manifest did not set it, so on a current Substrate every fresh deploy crash-loops: ate-env-api cannot reach ateapi and fails its startup atespace check (dial tcp ...:443: i/o timeout), while a pod started before the policy keeps working on its old connection, which hides the cause.

The generated Namespace now carries the label; both manifest tests assert it. Existing installs need kubectl label namespace ate-env ate.dev/api-access=true once, since are-apply of the manifest also adds it.

Verified on GKE at substrate ac5c5ee0: with the label the API pod starts, and create / exec / suspend / wake / delete pass.

[google-cla]

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.