Phase 0 clarifications: resolve 5 ambiguities surfaced by implementation

- docs/07: correct plaintext-secret enforcement — CI-time ciphertext check vs
  admission SOPS-provenance (Flux decrypts before the API server, so an admitted
  Secret carries no ciphertext; a 'reject plaintext' admission rule is impossible).
- docs/13: add Contract clarifications (v1.1) — source exactly-one-of; longhorn⇒size
  (L0 policy); backup is a {policy} ref; update.channel free-string/stable default;
  auth.groups required for oidc|forward-auth; public⇒auth.mode≠none (schema);
  irreplaceable⇒off-cluster-backup (L0 policy).
- docs/02: Cilium install ownership — Ansible bootstraps, Flux adopts config, value-parity contract.
- docs/03: platform label-key convention (homelab.keithjackson.dev/{egress-class,auth-mode,...}).
- docs/14: ServiceDefinition validation is two complementary L0 gates (JSON Schema shape + Kyverno invariants).

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

docs/07-security-and-secrets.md

@@ -23,10 +23,16 @@ Defense in depth with declarative, auditable controls:
   control, complementing network default-deny (the primary *isolation* control).
 - **Policy enforcement (admission)**: **Kyverno** runs in-cluster as an admission controller and
   rejects non-conforming resources at reconcile time — e.g. a namespace missing its default-deny
-  baseline, a plaintext Secret, a workload without a required egress-class label. The *same* policies
+  baseline, or a workload without a required egress-class/auth-mode label. The *same* policies
   gate CI ([14](14-testing-and-conformance.md), [ADR-0011](../decisions/adr-0011-test-tooling-kyverno-chainsaw.md)),
   so invariants are enforced both before merge and at admission (defense in depth). Enforcement
   complements — never replaces — the runtime behavior tests.
+  - **Plaintext-secret enforcement is split by layer (do not conflate):** the "no plaintext Secret"
+    invariant is a **CI-time** check (the committed Secret must carry SOPS ciphertext). It **cannot**
+    be an admission rule, because Flux **decrypts SOPS before** the object reaches the API server —
+    an admitted Secret never carries ciphertext, so an admission "reject plaintext" rule would reject
+    *every* real Secret. Admission instead enforces **SOPS provenance** (the Secret was reconciled
+    through the Flux/SOPS path), not ciphertext presence.
 - **Auditability**: isolation, egress path, cert validity, and backup integrity are all
   demonstrable (R-SEC-03) via Hubble, cert status, and DR drills.