In multitenant "tenant" mode, the operator name, its ServiceAccount and the
operator TLS Secret are suffixed with the Helm release name, so tenants sharing
a namespace no longer collide and no longer need manual unique-name overrides.

- New helpers in templates/_kedify-helpers.tpl (kept separate from the upstream
  _helpers.tpl to avoid rebase conflicts): keda.operator.name /
  keda.operator.serviceAccountName / keda.certificates.secretName. In "tenant"
  mode they return <value>-<release> (e.g. keda-operator-bar, kedaorg-certs-bar);
  in default / non-multitenant mode they return the configured value unchanged.
- serviceAccount.operator.name now tracks the operator name via the same
  suffixing. Previously the SA kept the fixed default "keda-operator" even when
  operator.name was overridden, which is what made a second same-namespace
  tenant install fail on ServiceAccount ownership.
- No values.yaml, values.schema.json or _helpers.tpl changes: defaults stay
  keda-operator / kedaorg-certs and are read as-is, only suffixed at render time
  in tenant mode.

A tenant now installs with just kedify.multitenant.mode=tenant + watchNamespace.

Backward compatible: default and mode=default renders are byte-identical to
before (verified with helm template diff across default, cert-manager,
network-policy, prometheus, PDB and azure-workload-identity value sets).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>