fix: resolve kustomize namespace conflict for gooseek-sandbox

- Extracted gooseek-sandbox Namespace to separate file
- Apply sandbox-namespace.yaml separately before kustomize
- Fixed deprecated commonLabels -> labels
- Prevents namespace transformation conflict

Made-with: Cursor

.gitea/workflows/deploy.yaml

@@ -52,6 +52,9 @@ jobs:
           export KUBECONFIG=/etc/rancher/k3s/k3s.yaml
           cd /opt/gitea-runner/workspace/gooseek/backend/deploy/k8s
           
+          # Apply sandbox namespace separately (not managed by kustomize)
+          kubectl apply -f sandbox-namespace.yaml
+          
           kubectl apply -k .
           
           kubectl -n gooseek rollout restart deployment/api-gateway || true