Params and namespaces

Declare defaults under nested params. The loader flattens them to namespace.key for runtime.

params:
  runtime:
    document_batch_size: 32
    parallelism:
      backend: processes
      workers: 4
  storage:
    user_id: dev
    project_id: dev
  domain:
    context_window_k: 3

becomes:

runtime.document_batch_size
runtime.parallelism.backend
runtime.parallelism.workers
storage.user_id
storage.project_id
domain.context_window_k

Allowed namespaces

Namespace	Who declares	Who reads
`domain.*`	step DRTML / UI	domain processor only
`runtime.*`	step + UI controls	partition loop / progress / UI
`storage.*`	step	storage session, compression, tenant paths, `storage.shuffle_buckets`
`mapping.*`	step	mapping / embed upstream runs
`reduce.*`	step	reduce_merge
`metrics.*`	step	offline dataset metrics
`flush.*`	step + flush controls	write buffer overrides
`compute.*`	step	algorithms
`tracking.*`	step	integrations when present
`postgres.*`	step (rare)	PG connection helpers
`qdrant.*`	step (rare)	Qdrant connection helpers

New namespaces must be added to ALLOWED_PARAM_NAMESPACES before use.

Rules

Framework never interprets domain.*; it only passes merged params through.
Numeric knobs belong in DRTML defaults, not Python literals.
UI fields must bind to live params (bind: / param:).
Defaults in Python are allowed only as named fallbacks that match DRTML when a key is absent (tests without a manifest).