T-0.5 Kyverno L0 policies + CLI tests + admission scaffolding (R-TEST-01, R-NET-01, R-SEC-01/02, R-IDP-02, R-GITOPS-02)

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

platform/kyverno/tests/resources/secrets.yaml

@@ -0,0 +1,25 @@
+# Secret fixtures for disallow-plaintext-secrets (R-SEC-01).
+# The "good" secret is shaped like a SOPS-encrypted manifest: values are ENC[...]
+# ciphertext and a top-level `sops` block (with a mac) is present. The "bad" secret
+# is plaintext with no `sops` block. NOTE: the ENC[...] strings below are fixtures,
+# not real ciphertext -- no plaintext secret material is present (docs/07 rule).
+apiVersion: v1
+kind: Secret
+metadata:
+  name: good-secret-sops
+  namespace: app-ns
+type: Opaque
+data:
+  password: ENC[AES256_GCM,data:Zm9vYmFy,iv:AAAA,tag:BBBB,type:str]
+sops:
+  mac: ENC[AES256_GCM,data:CCCC,iv:DDDD,tag:EEEE,type:str]
+  version: 3.8.1
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: bad-secret-plain
+  namespace: app-ns
+type: Opaque
+stringData:
+  password: hunter2-this-would-be-plaintext