ci(l0): fix kyverno test expectations for CLI 1.13.4; pin kyverno-json 0.0.3

The offline `kyverno test` CLI cannot resolve the Flux postBuild token
${KYVERNO_VALIDATION_ACTION} in validationFailureAction, so the 4 policies
carrying it failed to load and their result rows reported "Not found" (14/17
cases). Render a throwaway copy of platform/kyverno with the base/prod value
(Enforce) before `kyverno test` in both ci/l0.sh and scripts/run-l0.sh; this
does not change in-cluster enforcement.

Add tests/values.yaml supplying Namespace labels so the offline CLI resolves
namespaceSelector matches -- without it the R-SEC-02/R-NET-05/R-IDP-02 Pod
cases were silently EXCLUDED (vacuous), not evaluated.

Pin kyverno-json 0.0.3 in ci/versions.env (0.0.5 has no upstream release;
0.0.3 is what run-l0.sh and the devcontainer already use).

Co-Authored-By: Claude Opus 4.8 <[email protected]>

ci/versions.env

@@ -10,7 +10,7 @@
 
 # L0 policy gate (Kyverno CLI) + ServiceDefinition validation (kyverno-json)
 KYVERNO_VERSION="1.13.4"
-KYVERNO_JSON_VERSION="0.0.5"
+KYVERNO_JSON_VERSION="0.0.3"
 
 # L1/L2/L3 declarative runner (Chainsaw) — invoked via conformance/ entrypoint,
 # pinned here so a local run matches CI even before the in-cluster Job exists.