fix(kyverno): correct chart webhook schema (map + forceFailurePolicyIgnore)

Kyverno HelmRelease install failed at Helm templating: config.webhooks was a
LIST [{failurePolicy, namespaceSelector}], but the kyverno 3.3.9 chart expects
config.webhooks to be a MAP (webhooks.namespaceSelector) — the chart helper reads
.namespaceSelector off the value directly ('can't evaluate field namespaceSelector
in type []interface {}'). Also, failurePolicy is not a per-webhook field here; the
chart's global switch is config.forceFailurePolicyIgnore.enabled (bool).

Fix: config.webhooks -> map with namespaceSelector (system+platform excludes);
add config.forceFailurePolicyIgnore.enabled = ${KYVERNO_FORCE_FAILURE_POLICY_IGNORE}.
Renamed the cluster-var KYVERNO_WEBHOOK_FAILURE_POLICY (Fail/Ignore) ->
KYVERNO_FORCE_FAILURE_POLICY_IGNORE (false base / true dev). Verified with
helm template (renders 73 objects, no error); gate PASS.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

platform/kyverno/admission/helmrelease.yaml

@@ -44,22 +44,23 @@ spec:
       enabled: true
     cleanupController:
       enabled: true
-    # Webhook failure policy — cluster-vars knob (prod Fail / dev Ignore). Fail is fail-CLOSED
-    # (reject rather than silently admit when the webhook is unreachable, coordination-protocol.md
-    # #8); dev uses Ignore (fail-open) so a cold/unhealthy Kyverno cannot brick admission during
-    # bootstrap. The namespaceSelector ALSO excludes system + platform namespaces at the webhook
-    # layer — belt-and-suspenders: policies already scope to app-namespace=true, but this
-    # guarantees kube-system/flux-system/CNI/storage/monitoring admission never routes to Kyverno.
+    # config.webhooks is a MAP in the Kyverno chart (NOT a list — a list breaks the chart's
+    # webhook helper). namespaceSelector excludes system + platform namespaces at the webhook layer
+    # (belt-and-suspenders: the policies already scope to app-namespace=true). forceFailurePolicyIgnore
+    # is the chart's global fail-open switch — a cluster-vars knob: dev enables it (a cold/unhealthy
+    # Kyverno can't brick admission during bootstrap); prod disables it (fail-closed per
+    # coordination-protocol.md #8).
     config:
+      forceFailurePolicyIgnore:
+        enabled: ${KYVERNO_FORCE_FAILURE_POLICY_IGNORE}
       webhooks:
-        - failurePolicy: ${KYVERNO_WEBHOOK_FAILURE_POLICY}
-          namespaceSelector:
-            matchExpressions:
-              - key: kubernetes.io/metadata.name
-                operator: NotIn
-                values:
-                  - kube-system
-                  - flux-system
-                  - kyverno
-                  - longhorn-system
-                  - monitoring
+        namespaceSelector:
+          matchExpressions:
+            - key: kubernetes.io/metadata.name
+              operator: NotIn
+              values:
+                - kube-system
+                - flux-system
+                - kyverno
+                - longhorn-system
+                - monitoring