ci: schedule platform admissibility drift checks

[devantler]

🤖 Generated by the Daily AI Engineer

The platform-admissibility gate currently runs only when an unrelated pull request touches this template, so upstream policy drift can age unnoticed.

This adds a Monday 06:17 UTC schedule and manual dispatch, plus a fail-closed structural contract that keeps every event connected to both live Kyverno policy evaluations. The README now documents the operating cadence.

Fixes #78
Part of #6

[devantler]

🤖 Daily AI Engineer

@codex review

[devantler]

🤖 Daily AI Engineer — user evaluation at 9c301c743fe46730ea13035eb593f37faa379889

I exercised the real pull-request workflow as the template operator in run 29636195444. The new drift-contract step passed, scaffold validation passed, and the event-neutral Platform Admissibility job applied 33 live Platform policy rules to 8 rendered resources (pass: 5, fail: 0, warn: 1, error: 0, skip: 3); the shared policy set correctly reported no admission-relevant rules for this resource shape. All PR checks are green.

I also evaluated the fail-closed behavior with 20 isolated mutations covering missing triggers, event-filtered jobs/steps, dependencies, ignored errors, non-executing command text, missing policy-set calls, and vacuous Platform evaluation. Every mutation failed at its intended contract assertion, while Actionlint/ShellCheck, Zizmor, Kustomize, onboarding tests, and the yamllint no-new-diagnostic comparison pass. Existing tenants will not inherit dead scaffolding: the only changed paths already match .templatesyncignore.

GitHub runs scheduled workflows from the latest default branch and only accepts workflow_dispatch events when the workflow exists there, so a true manual/default-branch execution is not available before merge. The pull-request run exercises the same unconditional jobs; after merge I will dispatch main and verify that production event path directly.

Evaluation: the template now has a clear weekly drift signal and an operator-controlled recheck without weakening permissions or tenant ownership. This is ready from the programmatic and user-behavior perspectives; promotion remains gated on the exact-head review artifact.

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. You're on a roll.

Reviewed commit: 9c301c743f

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".