fix(kyverno): replace purged bitnami/kubectl cleanup image with bitnamilegacy

The kyverno chart's cleanup jobs (policyReportsCleanup, webhooksCleanup) default to
bitnami/kubectl:1.30.2, which Bitnami removed from Docker Hub (2024 catalog purge) ->
ImagePullBackOff. policyReportsCleanup is a Helm post-upgrade HOOK, so its failure
stalls every helm upgrade (5m timeout -> HelmRelease not-Ready -> platform Kustomization
blocked -> platform-config/apps cascade). Override both to Bitnami's relocated
bitnamilegacy/kubectl (identical image: /bin/bash + awk/wc/xargs + kubectl). Verified
via helm template that no bitnami/kubectl reference remains.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

platform/kyverno/admission/helmrelease.yaml

@@ -34,6 +34,17 @@ spec:
     remediation:
       retries: 3
   values:
+    # The chart's cleanup Jobs default to bitnami/kubectl:1.30.2, which Bitnami PURGED from Docker Hub
+    # (2024 catalog change) → the jobs ImagePullBackOff. policyReportsCleanup runs as a Helm
+    # post-upgrade HOOK, so its failure STALLS every helm upgrade (5m timeout → HelmRelease not-Ready →
+    # platform Kustomization blocks). Point both cleanup images at Bitnami's relocated `bitnamilegacy`
+    # mirror — the identical image (has /bin/bash + awk/wc/xargs + kubectl the jobs need). Pinned tag.
+    policyReportsCleanup:
+      image:
+        repository: bitnamilegacy/kubectl
+    webhooksCleanup:
+      image:
+        repository: bitnamilegacy/kubectl
     # Admission controller replicas — cluster-vars knob (prod 3 / dev 1). HA so a single pod
     # restart cannot open an enforcement gap; dev drops to 1 to save RAM during bootstrap.
     admissionController: