evaluator: deduplicate namespace selector matching via shared helper

[Copilot]

matchesNamespaceSelector and matchesNamespaceSelectorV1Beta1 had identical implementations differing only in the binding type, risking silent divergence.

Changes

• New helper matchesNamespaceSelectorByLabelSelector(*metav1.LabelSelector, *unstructured.Unstructured) (bool, error) — package-level function containing the shared selector evaluation logic
• Refactored wrappers — both original methods now only nil-check their binding/matchResources before delegating to the helper

func matchesNamespaceSelectorByLabelSelector(
    labelSelector *metav1.LabelSelector,
    namespaceObj *unstructured.Unstructured,
) (bool, error) { ... }

func (e *Evaluator) matchesNamespaceSelector(
    binding *admissionregv1.ValidatingAdmissionPolicyBinding, ...
) (bool, error) {
    if binding == nil || binding.Spec.MatchResources == nil {
        return true, nil
    }
    return matchesNamespaceSelectorByLabelSelector(binding.Spec.MatchResources.NamespaceSelector, namespaceObj)
}

func (e *Evaluator) matchesNamespaceSelectorV1Beta1(
    binding *admissionv1beta1.MutatingAdmissionPolicyBinding, ...
) (bool, error) {
    if binding == nil || binding.Spec.MatchResources == nil {
        return true, nil
    }
    return matchesNamespaceSelectorByLabelSelector(binding.Spec.MatchResources.NamespaceSelector, namespaceObj)
}

---

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.