Handle namespace creation cleanly in `apply`

If we define a service in a new namespace we don't create the namespace first even when we have a `kind: Namespace` which leads to missing namespace errors.  Switch to 2-phase apply maybe?