Golden actor should run in the same atespace as the ActorTemplate #2533

Create the golden actor in the template's atespace, not the reserved ate-golden one.

Description:

Today every template's golden actor runs in the reserved, system-owned ate-golden atespace (GoldenActorAtespace, template_reconciler.go), not in the atespace the ActorTemplate belongs to. Running it in the template's own atespace instead:

• The golden snapshot is taken under the same atespace-scoped config (access policy, storage grants, etc.) that the actors restored from it run under, so the golden boot sees the same environment as a real actor.
• Storage access stays per tenant. With ate-golden, the golden tag is stored under atespaces/ate-golden/... of every template's storageLocation, so every bucket needs an extra grant for ate-golden on top of the per-atespace grants (api-guide).
• No more system atespace that the reconciler has to create on demand.

Code also uses "atespace == ate-golden" to special-case golden actors. Golden actors should not be exceptions: drop these checks rather than replace them with another way to identify golden actors. The golden actor follows the same rules as any other actor, including the template's preferredFidelity.

Tasks:

• Create the golden actor and golden tag in the template's atespace. Pick a name that cannot collide with user actors/tags in that atespace (today the name is the template UID).
• Drop every golden special case keyed on atespace.
  • ateapi: the MEMORY fidelity override in preferredFidelity, the pause rejection, and the worker-initiated suspend rejection.
  • atelet: the UploadPausedCheckpoint validation, and the golden snapshot kind in metrics (ateattr.SnapshotKindGolden). Golden snapshots are reported as latest.
• Remove GoldenActorAtespace and the on-demand atespace creation in the reconciler.
• Update docs (api-guide storage layout and IAM example) and the DeleteActorTemplate proto comment.