ci(l0): fix kyverno test expectations for CLI 1.13.4; pin kyverno-json 0.0.3

The offline `kyverno test` CLI cannot resolve the Flux postBuild token
${KYVERNO_VALIDATION_ACTION} in validationFailureAction, so the 4 policies
carrying it failed to load and their result rows reported "Not found" (14/17
cases). Render a throwaway copy of platform/kyverno with the base/prod value
(Enforce) before `kyverno test` in both ci/l0.sh and scripts/run-l0.sh; this
does not change in-cluster enforcement.

Add tests/values.yaml supplying Namespace labels so the offline CLI resolves
namespaceSelector matches -- without it the R-SEC-02/R-NET-05/R-IDP-02 Pod
cases were silently EXCLUDED (vacuous), not evaluated.

Pin kyverno-json 0.0.3 in ci/versions.env (0.0.5 has no upstream release;
0.0.3 is what run-l0.sh and the devcontainer already use).

Co-Authored-By: Claude Opus 4.8 <[email protected]>

ci/l0.sh

@@ -52,12 +52,25 @@ elif [ ! -d "$KYVERNO_POLICY_DIR" ] || ! compgen -G "${KYVERNO_POLICY_DIR}/**/ky
   skip "no kyverno-test.yaml under '${KYVERNO_POLICY_DIR}' (T-0.5 / platform/kyverno not delivered yet) — UNWIRED, not green"
   summary "- kyverno-l0: **SKIPPED** (no policy tests yet — T-0.5)"
 else
-  if kyverno test "$KYVERNO_POLICY_DIR"; then
+  # The ClusterPolicies carry a Flux postBuild token in validationFailureAction
+  # (${KYVERNO_VALIDATION_ACTION}, substituted in-cluster from
+  # clusters/base/cluster-vars.yaml). The offline `kyverno test` CLI does NOT run
+  # Flux substitution, so the literal token is an invalid enum value and those
+  # policies fail to load (no result rows -> "Not found"). Render a throwaway copy
+  # with the base/prod value (Enforce — the strict posture the gate must prove)
+  # before testing. This does not change what the policies enforce in-cluster.
+  : "${KYVERNO_VALIDATION_ACTION:=Enforce}"
+  l0_render="$(mktemp -d)"
+  cp -a "${KYVERNO_POLICY_DIR}/." "$l0_render/"
+  find "$l0_render" -type f -name '*.yaml' -print0 \
+    | xargs -0 sed -i "s/\${KYVERNO_VALIDATION_ACTION}/${KYVERNO_VALIDATION_ACTION}/g"
+  if kyverno test "$l0_render"; then
     ok "Kyverno L0 policy tests passed"
     summary "- kyverno-l0: **passed**"
   else
     err "Kyverno L0 policy tests failed"; summary "- kyverno-l0: **FAILED**"; rc=1
   fi
+  rm -rf "$l0_render"
 fi
 
 case "$rc" in

ci/versions.env

@@ -10,7 +10,7 @@
 
 # L0 policy gate (Kyverno CLI) + ServiceDefinition validation (kyverno-json)
 KYVERNO_VERSION="1.13.4"
-KYVERNO_JSON_VERSION="0.0.5"
+KYVERNO_JSON_VERSION="0.0.3"
 
 # L1/L2/L3 declarative runner (Chainsaw) — invoked via conformance/ entrypoint,
 # pinned here so a local run matches CI even before the in-cluster Job exists.