Configuration management database (CMDB) module within an AI SRE AgenticOps platform for Kubernetes. Specifically, the discrepancy between reported and actual namespace scoping for CMDB analysis.

The CMDB module deliberately reads its own namespace allow-list variable, and there's a helpful comment explaining *why* it must not reuse the remediation allow-list:

`cmdb/local_cmdb.py:79`

```python
# Topology is read-only. Do not reuse the remediation allowlist here, otherwise
# a safe mutation boundary silently hides most clusters from CMDB analysis.
raw = os.getenv("CMDB_ALLOWED_NAMESPACES", "all")
```

But the readiness endpoint echoes a *different* variable:

`cmdb/local_cmdb.py:708`

```python
"allowed_namespaces": os.getenv("ALLOWED_NAMESPACES", "all"),
```

## The question

Is the `/ready` field meant to report the effective CMDB scope, or the remediation scope? As written it reports neither reliably for CMDB:

- Operator sets `CMDB_ALLOWED_NAMESPACES=team-a` to scope topology to one team, then hits `/ready` to confirm — and sees `allowed_namespaces: "all"` (because `ALLOWED_NAMESPACES` is unset). The health check contradicts the actual filter.
- Conversely, setting only `ALLOWED_NAMESPACES` makes `/ready` claim a scope that CMDB filtering ignores.

Given the readiness endpoint exists precisely so operators can verify effective scope, this looks like a copy/paste of the wrong env var name rather than intentional.

## Suggested fix

Report the same source the filter uses (or reuse the existing `_allowed_namespaces()` helper):

```python
"allowed_namespaces": os.getenv("CMDB_ALLOWED_NAMESPACES", "all"),
```

If reporting the remediation allow...