Add orbit_enroll_namespace flag for KG enrollment

Jean-Gabriel Doyonrequested to merge
feature/orbit-enroll-namespace-feature-flag into master

What does this MR do and why?

Namespace enrollment for Knowledge Graph (Orbit) currently has no rollout control, so any admin or group owner can enable it for any namespace. This adds the orbit_enroll_namespace ops feature flag to gate enrollment while leaving unenrollment ungated so owners can always opt out.

  • New orbit_enroll_namespace ops feature flag, default enabled (no behavior change on deploy)
  • Enrollment blocked at both the service layer and admin REST API when the flag is disabled for a namespace
  • Unenrollment intentionally bypasses the flag so namespaces can always be removed
  • Flag is actor-scoped (per namespace) for gradual rollout

References

MR acceptance checklist

Evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.

Merge request reports