T-0.5 Kyverno L0 policies + CLI tests + admission scaffolding (R-TEST-01, R-NET-01, R-SEC-01/02, R-IDP-02, R-GITOPS-02)

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

platform/kyverno/tests/resources/networkpolicies.yaml

@@ -0,0 +1,40 @@
+# NetworkPolicy fixtures for validate-default-deny-shape (R-NET-01).
+# The "good" baseline denies both directions; the "bad" baseline is labelled as the
+# baseline but only covers Ingress -- leaving egress open -- and must be rejected.
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: good-baseline-np
+  namespace: app-ns
+  labels:
+    homelab.keithjackson.dev/baseline: default-deny
+spec:
+  podSelector: {}
+  policyTypes:
+    - Ingress
+    - Egress
+  ingress: []
+  egress:
+    - to:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: kube-system
+      ports:
+        - protocol: UDP
+          port: 53
+        - protocol: TCP
+          port: 53
+---
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: bad-baseline-np
+  namespace: app-ns
+  labels:
+    homelab.keithjackson.dev/baseline: default-deny
+spec:
+  podSelector: {}
+  # Missing Egress -> egress is left wide open despite claiming to be the baseline.
+  policyTypes:
+    - Ingress
+  ingress: []