T-0.5 Kyverno L0 policies + CLI tests + admission scaffolding (R-TEST-01, R-NET-01, R-SEC-01/02, R-IDP-02, R-GITOPS-02)

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

platform/kyverno/servicedefinition/payloads/valid-plex.yaml

@@ -0,0 +1,22 @@
+# VALID ServiceDefinition (R-GITOPS-02). Modelled on catalog service #1 (plex,
+# docs/13): public, internet egress, native auth (Plex), longhorn + bulk storage.
+name: plex
+kind: container
+source:
+  image: plexinc/pms-docker
+exposure: public
+egress: internet
+storage:
+  - name: config
+    size: 10Gi
+    class: longhorn
+  - name: media
+    class: bulk
+auth:
+  mode: native
+update:
+  channel: stable
+  cadence: weekly
+  autoRollbackOnFailedHealth: true
+observability:
+  metrics: true