Phase 0 clarifications: resolve 5 ambiguities surfaced by implementation

- docs/07: correct plaintext-secret enforcement — CI-time ciphertext check vs
  admission SOPS-provenance (Flux decrypts before the API server, so an admitted
  Secret carries no ciphertext; a 'reject plaintext' admission rule is impossible).
- docs/13: add Contract clarifications (v1.1) — source exactly-one-of; longhorn⇒size
  (L0 policy); backup is a {policy} ref; update.channel free-string/stable default;
  auth.groups required for oidc|forward-auth; public⇒auth.mode≠none (schema);
  irreplaceable⇒off-cluster-backup (L0 policy).
- docs/02: Cilium install ownership — Ansible bootstraps, Flux adopts config, value-parity contract.
- docs/03: platform label-key convention (homelab.keithjackson.dev/{egress-class,auth-mode,...}).
- docs/14: ServiceDefinition validation is two complementary L0 gates (JSON Schema shape + Kyverno invariants).

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

docs/14-testing-and-conformance.md

@@ -122,6 +122,12 @@ from the **Kyverno ecosystem**:
   behavior tests**: a policy admitting a manifest is not proof the runtime behaves (R-TEST-01), so
   L2/L3 Chainsaw tests remain mandatory. Policies are authored once and shared between the CLI gate
   and the admission controller.
+  - **ServiceDefinition validation is two complementary gates, not one** (do not consolidate): the
+    **JSON Schema** (`schemas/servicedefinition.schema.json`) checks *shape* — types, enums, required
+    fields, exactly-one-of `source`, `public ⇒ auth.mode≠none` — as a fast, cluster-free PR check;
+    **Kyverno `kyverno-json`** enforces the *cross-cutting invariants* the schema can't express
+    (`longhorn ⇒ size`, irreplaceable⇒off-cluster-backup, label conventions). Both are L0 and run in
+    CI; they overlap by design (defense in depth), not by redundancy.
 - **Chainsaw** — **L1 rendering, L2 behavioral, and L3 fault-injection.** Declarative steps
   (apply/assert/error, `script`/`command`, `try`/`catch`/`finally`), bounded polling with explicit
   timeouts, per-test namespace isolation, and automatic cleanup satisfy the reproducibility contract.