Controller: default nodeSelector for agent Deployments (parallel to --default-agent-pod-labels) #2258

Problem

The controller supports --default-agent-pod-labels (DEFAULT_AGENT_POD_LABELS), applied to every agent pod template, but there is no equivalent for nodeSelector. spec.declarative.deployment.nodeSelector exists per-Agent, but agents created through the dashboard wizard carry no nodeSelector at all.

In clusters with admission policies that require a nodeSelector on every Deployment (a common Gatekeeper/Kyverno pattern for cost/scheduling governance), every wizard-created agent Deployment is denied at admission. Cluster operators currently have to work around this with an external mutation webhook (we use a Gatekeeper Assign scoped to the agents namespace).

Proposal

Add --default-agent-node-selector (DEFAULT_AGENT_NODE_SELECTOR), same comma-separated key=value format and precedence semantics as --default-agent-pod-labels: applied to all agent Deployments, per-Agent deployment.nodeSelector wins.

Chart-side this would surface naturally as controller.agentDeployment.nodeSelector, next to the existing agentDeployment.podLabels / agentDeployment.serviceAccountName.

Happy to send a PR if this direction is acceptable.