T-0.5 Kyverno L0 policies + CLI tests + admission scaffolding (R-TEST-01, R-NET-01, R-SEC-01/02, R-IDP-02, R-GITOPS-02)

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

platform/kyverno/tests/resources/namespaces.yaml

@@ -0,0 +1,16 @@
+# Namespace fixtures. `app-ns` carries the application-namespace marker so the
+# namespaceSelector-scoped policies apply; `platform-ns` does not, proving that
+# platform/system namespaces are correctly OUT of scope.
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: app-ns
+  labels:
+    homelab.keithjackson.dev/app-namespace: "true"
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: platform-ns
+  labels:
+    kubernetes.io/metadata.name: platform-ns