Function validate_seed_secret_namespace 

pub fn validate_seed_secret_namespace(
    seed: Option<&SeedSpec>,
    repository_namespace: &str,
) -> ValidationResult

The namespaced arm of the co-resident seed-Secret rule: a Repository’s blob-mode seed source Secret must be unset or name the repository’s OWN namespace, because the seeding Job runs there and envFrom is namespace-local. Needs the CR’s namespace, which the spec does not carry, so the webhook calls it with req.namespace (the cluster-scoped arm — “must be unset” — is fully spec-derivable and lives in validate_repository_seed).

use kopiur_api::seed::{SeedSpec, SeedSource};
use kopiur_api::validate::validate_seed_secret_namespace;

let seed_with = |ns: serde_json::Value| -> SeedSpec {
    let from: SeedSource = serde_json::from_value(serde_json::json!({
        "backend": { "s3": { "bucket": "mirror", "auth": { "secretRef": ns } } }
    }))
    .unwrap();
    SeedSpec { from, sync: None, migrate: None, allow_empty_source: false,
               failure_policy: None, credential_projection: None }
};
// Unset namespace = "the repository's own" → fine.
let ok = seed_with(serde_json::json!({ "name": "mirror-creds" }));
assert!(validate_seed_secret_namespace(Some(&ok), "backups").is_ok());
// Same namespace spelled out → also fine.
let same = seed_with(serde_json::json!({ "name": "mirror-creds", "namespace": "backups" }));
assert!(validate_seed_secret_namespace(Some(&same), "backups").is_ok());
// Another namespace → the Job could never read it.
let other = seed_with(serde_json::json!({ "name": "mirror-creds", "namespace": "elsewhere" }));
assert!(validate_seed_secret_namespace(Some(&other), "backups").is_err());