pub fn extract_namespace(value: &Value) -> Option<String>
Extract namespace from a manifest (returns None for cluster-scoped resources)