Merge feature/p0-integration into main

Wire kyverno admission bundle into the platform render.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

platform/kustomization.yaml

@@ -11,7 +11,7 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
-  # - kyverno            # TODO(PM): enable when the policy engineer's kyverno stub lands (WS-TEST)
+  - kyverno              # PM: enabled — admission enforcer first so policies precede other components
   - cilium
   - longhorn
   - cert-manager

platform/kyverno/kustomization.yaml

@@ -0,0 +1,10 @@
+# PM integration glue (Phase 0): makes platform/kyverno a Flux platform component.
+# Renders the in-cluster ENFORCING bundle authored by WS-TEST (admission/) — Kyverno install
+# + the policies shared verbatim with the CI L0 gate (ADR-0011, docs/07 admission enforcement).
+#
+# The CI-only artifacts (tests/, servicedefinition/ payloads, scripts/run-l0.sh) are intentionally
+# NOT rendered into the cluster — they run in CI (.gitea/ + ci/), not in-cluster.
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - admission