Align scaffold CPU request with Platform VPA floor

[devantler]

🤖 Generated by the Agentic Engineer

Evidence

At template main daedcb44b51608c2002480436c075be3f560244d, deploy/deployment.yaml requests 10m CPU for the application container.

Platform main 6b67c9454e73fe7faf94d3be39bf874ba194b8e1 generates a VPA for every Deployment and sets the wildcard container floor to 50m. Its policy records that even 15m throttled fresh Node/Next.js starts into liveness failures. The template value predates that Platform floor by eight days.

The weekly scaffold drift gate cannot catch this mismatch because it removes every Kyverno generate rule before evaluating the Platform policy set.

Audience and impact

Every new tenant starts from this Deployment. Its first pod can begin below the Platform's recorded cold-start floor before VPA has a recommendation, making the supposedly day-one-admissible scaffold carry an avoidable startup-throttling risk.

Expected behaviour

The scaffold's initial application request should never be lower than the one unambiguous CPU minimum generated by the live Platform VPA policy. A Platform floor change must fail the template's drift gate with the exact remediation instead of silently diverging.

Acceptance criteria

• The scaffold application container requests at least the live Platform-generated VPA CPU minimum.
• Validation derives that minimum from Platform main and fails closed when the applicable generate rule or CPU floor is missing, duplicated, ambiguous, or malformed.
• Negative controls prove rejection of a lowered scaffold request, a removed VPA rule, and a changed Platform floor.
• A one-shot rename and render preserves the compliant request on the adopted Deployment.
• The default adoption path gains the safer cold-start floor without adding an adopter input or manual step.

Size

S-M: a default correction plus a narrow fail-closed cross-repository contract.

[coderabbitai]

🔗 Related PRs

#60 - fix(onboarding): rename SecretStore tenant identity [merged]
#94 - test: validate live Platform tenant envelope [merged]
#96 - test: validate the generated Platform network floor [merged]
#98 - test: validate signed tenant artifact handoff [merged]

---

📝 Issue Planner

_{Check the box below or use the @coderabbitai plan command to generate an implementation plan and prompts that you can use with your favorite coding assistant.}

• Create Plan

---

🧪 Issue enrichment is currently in open beta.

You can configure auto-planning by selecting labels in the issue_enrichment configuration.

To disable automatic issue enrichment, add the following to your .coderabbit.yaml:

issue_enrichment:
  auto_enrich:
    enabled: false

💬 Have feedback or questions? Drop into our discord!