Add graphQL error code NO_DEFAULT_NAMESPACE and handle it on FE

What does this MR do and why?

Problem

When users encounter permission errors in Duo Chat/Workflows, they receive a generic message: "You don't have permission to access this workflow". This message doesn't help users understand the root cause or how to resolve it.

There are two distinct scenarios that can trigger this error:

1. The user belongs to multiple groups but hasn't selected a default namespace
2. The user's selected namespace doesn't have the required Duo permissions

Solution

This MR adds error codes to GraphQL permission errors, allowing the frontend to distinguish between different failure scenarios and display actionable guidance to users.

On the Frontend we handle the error inside the agentic chat and display the "select namespace" empty state.

How it works

When a permission check fails, the resolver now:

1. Checks if the user has a default namespace configured via duo_default_namespace_with_fallback
2. Checks if the user has multiple namespace candidates
3. Returns NO_DEFAULT_NAMESPACE if both conditions indicate the user needs to select a default
4. Returns INSUFFICIENT_NAMESPACE_PERMISSIONS otherwise (we are currently not handling this on the frontend so this is just an error message)

References

• Do not disable Agentic Chat if default namespac... (#587304 - closed)

Screenshots or screen recordings

Before	After

How to set up and validate locally

1. You need to setup two namespaces with duo. One duo core and one duo pro
2. Have a member that belongs to both namespaces and have not set theirs default namespace
3. Go to duo pro namespace and try to communicate with duo agentic chat
4. With this fix the user should see the empty chat state asking user to setup the default namespace

MR acceptance checklist

Evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.