T-0.5 Kyverno L0 policies + CLI tests + admission scaffolding (R-TEST-01, R-NET-01, R-SEC-01/02, R-IDP-02, R-GITOPS-02)

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

platform/kyverno/servicedefinition/payloads/invalid-bad-dependency.yaml

@@ -0,0 +1,14 @@
+# INVALID: a dependency uses protocol 'sctp' (not tcp|udp) and an out-of-range port
+# (docs/13 dependencies shape). Rejected.
+name: baddep
+kind: container
+source:
+  image: registry.example/app
+exposure: internal
+egress: internet
+dependencies:
+  - to: plex
+    port: 70000
+    protocol: sctp
+auth:
+  mode: forward-auth