How do Linux Cgroups (Control Groups) and Namespaces create isolation within a Docker container? What happens to a Python process when it exceeds the resource.limits.cpu in Kubernetes, and why does exceeding limits.memory lead to OOMKilled, while exceeding CPU only causes throttling?