test: ensure single/own namespace increase coverage for both runtimes

Add E2E test scenarios for single/own namespace support that run for
both Helm and Boxcutter runtimes:

1. Invalid DNS-1123 watchNamespace - tests namespace name validation
2. Reject watchNamespace for AllNamespaces-only operators

Tests use assertions compatible with both runtimes. Unit tests in
provider_test.go provide comprehensive validation coverage via shared
RegistryV1ManifestProvider.

Achieves 100% parity with downstream OCP test coverage.

Author: camilamacedo86

test/e2e/features/install.feature

@@ -298,6 +298,67 @@ Feature: Install ClusterExtension
         mutate: true
       """
 
+  @SingleOwnNamespaceInstallSupport
+  Scenario: Report failure when watchNamespace has invalid DNS-1123 name
+    Given ServiceAccount "olm-admin" in test namespace is cluster admin
+    When ClusterExtension is applied
+      """
+      apiVersion: olm.operatorframework.io/v1
+      kind: ClusterExtension
+      metadata:
+        name: ${NAME}
+      spec:
+        namespace: ${TEST_NAMESPACE}
+        serviceAccount:
+          name: olm-admin
+        config:
+          configType: Inline
+          inline:
+            watchNamespace: invalid-namespace-
+        source:
+          sourceType: Catalog
+          catalog:
+            packageName: single-namespace-operator
+            selector:
+              matchLabels:
+                "olm.operatorframework.io/metadata.name": test-catalog
+      """
+    Then ClusterExtension reports Progressing as True with Reason Retrying and Message includes:
+      """
+      invalid-namespace-
+      """
+
+  @SingleOwnNamespaceInstallSupport
+  @WebhookProviderCertManager
+  Scenario: Reject watchNamespace for operator that does not support Single/OwnNamespace install modes
+    Given ServiceAccount "olm-admin" in test namespace is cluster admin
+    When ClusterExtension is applied
+      """
+      apiVersion: olm.operatorframework.io/v1
+      kind: ClusterExtension
+      metadata:
+        name: ${NAME}
+      spec:
+        namespace: ${TEST_NAMESPACE}
+        serviceAccount:
+          name: olm-admin
+        config:
+          configType: Inline
+          inline:
+            watchNamespace: ${TEST_NAMESPACE}
+        source:
+          sourceType: Catalog
+          catalog:
+            packageName: webhook-operator
+            selector:
+              matchLabels:
+                "olm.operatorframework.io/metadata.name": test-catalog
+      """
+    Then ClusterExtension reports Progressing as True with Reason Retrying and Message includes:
+      """
+      watchNamespace
+      """
+
   @BoxcutterRuntime
   @ProgressDeadline
   Scenario: Report ClusterExtension as not progressing if the rollout does not complete within given timeout