fix: restore kube-system for sealed-secrets-controller refs

Reverts docs changes from 143b2c3 that incorrectly replaced
kube-system with headlamp for sealed-secrets-controller commands.

The sealed-secrets-controller runs in kube-system, NOT headlamp.
Only the Headlamp app install namespace was changed to headlamp.

Changes:
- Revert -n headlamp → -n kube-system in all sealed-secrets-controller
  kubectl commands across all docs files
- Revert sealed-secrets-controller.kube-system DNS reference
- Revert --controller-namespace=headlamp → --controller-namespace=kube-system
- Revert 'namespace headlamp' → 'namespace kube-system' in error messages

Co-Authored-By: Paperclip <noreply@paperclip.ing>

docs/troubleshooting/permission-errors.md

@@ -202,11 +202,11 @@ Missing service access permission.
 
 ```bash
 # Check service access
-kubectl auth can-i get services -n headlamp
-kubectl auth can-i get services/sealed-secrets-controller -n headlamp
+kubectl auth can-i get services -n kube-system
+kubectl auth can-i get services/sealed-secrets-controller -n kube-system
 
 # Check proxy access
-kubectl auth can-i get services/proxy -n headlamp
+kubectl auth can-i get services/proxy -n kube-system
 ```
 
 #### Solution
@@ -563,7 +563,7 @@ TOKEN=$(kubectl create token sealed-secrets-ci -n ci-cd)
 
 # Use with kubeseal
 echo -n mysecret | kubeseal \
-  --controller-namespace=headlamp \
+  --controller-namespace=kube-system \
   --token="$TOKEN" \
   --format=yaml
 ```