Phase 0 clarification follow-ups + reconcile CI integration seams

Adopt the spec's Phase-0 clarifications (spec now at pin a7fc19f) into the impl:
- schema v1.1: enforce exposure:public => auth.mode!=none (positive+negative tested).
- Kyverno: add longhorn=>size and longhorn=>NOT-reacquirable invariants (R-STATE-02/03).
- Ratify the homelab.keithjackson.dev/* label-key convention (now in spec docs/03).
- R-TEST-06 spec-immutability gate: ci/SPEC_PIN + ci/spec-immutability.sh + gate.sh
  stage + Makefile target + a Gitea job (checks spec repo clean & at pin).
- touched-requirements.sh: conformance tags are the authoritative source.

Reconcile 3 CI seams the CI worker flagged (gate was RED, now GREEN):
- create schemas/validate.sh (SCHEMA_VALIDATE_CMD entrypoint) — L0 schema gate runs.
- fix l1.sh/conformance.sh to run.sh's real interface (fixed _artifacts/ paths; no
  --junit/--coverage) and collect artifacts.
- exec bits on new scripts.

make -C ci gate => PASS (l0 skips locally w/o kyverno binary; green in CI).

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

platform/kyverno/labels.md

@@ -1,11 +1,11 @@
-# Platform label/annotation convention (PROPOSED contract)
+# Platform label/annotation convention (RATIFIED)
 
 These label keys are consumed by the Kyverno policies in this directory. The **values**
-are fixed by the spec; the **keys** are a convention this workstream (WS-TEST) proposes
-and are a **shared contract** with WS-NET (network/egress rendering), WS-SEC (auth), and
-WS-GITOPS (ServiceDefinition → manifest rendering). Per
-[`agents/coordination-protocol.md` §2] a contract like this needs the owning roles'
-sign-off before it is locked. **Escalated as an open question in the T-0.5 report.**
+are fixed by the spec; the **keys** are the platform convention, now **ratified in the
+spec** — `homelab.keithjackson.dev/{egress-class,auth-mode,app-namespace,baseline}` are
+documented in `docs/03-networking-isolation-and-egress.md` ("Platform label-key
+convention") as the contract that network policies, Kyverno rules, and renderers key off.
+Shared contract with WS-NET (egress rendering), WS-SEC (auth), and WS-GITOPS (rendering).
 
 | Label key | Applied to | Values | Fixed by | Used by policy |
 |---|---|---|---|---|

platform/kyverno/servicedefinition/validate-servicedefinition.yaml

@@ -17,7 +17,7 @@ kind: ValidatingPolicy
 metadata:
   name: validate-servicedefinition
   annotations:
-    homelab.keithjackson.dev/requirements: R-GITOPS-02
+    homelab.keithjackson.dev/requirements: R-GITOPS-02,R-STATE-02,R-STATE-03
 spec:
   rules:
     - name: servicedefinition-shape
@@ -63,3 +63,17 @@ spec:
             check:
               ~.storage:
                 (class == 'longhorn' || class == 'bulk'): true
+          # docs/13 v1.1: longhorn (replicated, irreplaceable) volumes MUST be sized (R-STATE-02).
+          # bulk may omit size (external mount, sized outside the cluster).
+          - message: "a `longhorn` volume requires an explicit `size` (docs/13 v1.1; R-STATE-02)"
+            check:
+              ~.storage:
+                (class != 'longhorn' || size != null): true
+    - name: servicedefinition-backup
+      # docs/13 v1.1: irreplaceable (longhorn-tier) state MUST NOT be `reacquirable` — it must
+      # reference an off-cluster backup schedule (R-STATE-03). Only bulk-tier data may be reacquirable.
+      assert:
+        all:
+          - message: "backup.policy 'reacquirable' is not allowed when any volume is on the longhorn (irreplaceable) tier; reference an off-cluster schedule (docs/13 v1.1; R-STATE-03)"
+            check:
+              (backup.policy == 'reacquirable' && storage != null && contains(storage[].class, 'longhorn')): false