docs: the Flux->Gitea allowance is rendered and Flux-adopted — debt closed

Co-Authored-By: Claude Opus 5 <[email protected]>

DECISIONS-LOG.md

@@ -2486,9 +2486,18 @@ was denied (`wget` timed out).
 `gitea-allow-flux-ingress` (ns gitea) is **applied live and NOT in git**, carrying a provenance
 annotation. It is what stops the deadlock above recurring. It cannot simply be added:
 `apps/wave-0/gitea.yaml` is a render golden and `catalog/render.py` generates gitea's CNPs from
-`ingressRoutes:`, with no field for an in-cluster client. Being landed on
-`fix/gitea-allow-flux-ingress-rendered` as a renderer-contract change. **Until then, one
-`kubectl delete` or a cluster rebuild re-creates the deadlock.**
+`ingressRoutes:`, with no field for an in-cluster client.
+
+**CLOSED same day (`eda4a9f`).** The renderer contract gained an optional `inClusterClients`
+field (schema 1.5.0): `{namespace, port, protocol?, name?}`, rendering one least-privilege CNP
+per entry — namespace-scoped `fromEndpoints`, only the declared port, no `fromEntities`
+widening. The optional `name` exists precisely so the allowance could be authored under the
+live object's EXISTING name, letting Flux adopt it **in place** instead of creating a second
+policy beside an unmanaged one. The rendered spec was verified byte-identical to the live
+object (normalized JSON diff empty; the only difference was two annotations, which do not
+affect policy evaluation) — so adoption caused no policy recompute and no flap on prod's own
+source. Confirmed live: managedFields moved from `kubectl-client-side-apply` to
+`kustomize-controller` with `srcReady=True` throughout, then 14/14 tiers.
 
 ### Other outcomes