[feature] Tenant Watcher

[IfSentient]

Some apps require knowing when a new tenant has been provisioned to create some initial objects in that tenant's namespace. This can currently be accomplished with a simple watcher on Namespace objects, but there is no guarantee that the namespace is for a tenant. Cloud should soon be supporting tenant objects which are provisioned when a new tenant is, which can be monitored to know about new tenants. However, due to the reconciliation pattern, the tenant may precede the namespace. The app-sdk should provide a simple mechanism for being notified of new tenants (or tenant deletion) only when the namespace is also ready.