T-0.2 CI merge-gate pipeline + portable local runners (R-TEST-02/03, R-GITOPS-01)

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

ci/versions.env

@@ -0,0 +1,22 @@
+# ci/versions.env — pinned tool versions (R-TEST-02: reproducible, version-pinned)
+#
+# Single source of truth for every tool the gate invokes. The Gitea Actions
+# workflow and the local scripts both source this file so CI and a laptop run
+# the exact same versions. Bump deliberately; a version change is a code change
+# that must go through the normal feature-branch -> main gate.
+#
+# Owner: WS-GITOSS (CI). The Kyverno/Chainsaw versions MUST stay in lockstep with
+# whatever platform/kyverno and conformance/ pin — see integration notes in README.
+
+# L0 policy gate (Kyverno CLI) + ServiceDefinition validation (kyverno-json)
+KYVERNO_VERSION="1.13.4"
+KYVERNO_JSON_VERSION="0.0.5"
+
+# L1/L2/L3 declarative runner (Chainsaw) — invoked via conformance/ entrypoint,
+# pinned here so a local run matches CI even before the in-cluster Job exists.
+CHAINSAW_VERSION="0.2.12"
+
+# Lint / manifest tooling
+YAMLLINT_VERSION="1.35.1"
+KUBECTL_VERSION="1.31.4"
+YQ_VERSION="4.44.6"