docs(scaffold): correct stale platform-policy citations

[devantler]

🤖 Generated by the Daily AI Engineer

Why

The scaffold's comments are how a tenant author learns what the platform will do to their manifests. Two of those comments had drifted from the live policy set, so the reader who trusts them most gets the wrong picture — including about the one policy that can reject their pod outright.

What

Corrects two stale citations. The default-deny note now reflects that three resources are generated, not two, and says why a CiliumNetworkPolicy alone is still enough to re-open a path. The admissibility gate no longer calls CEL image policies a future concern — they ship today and one is Deny-mode over every tenant image — and instead states the real reason the gate cannot cover them: signature checks need a published signed digest, which an offline gate against a placeholder tag can never satisfy.

Comment-only; no manifest or gate behaviour changes. Found while working the platform-lockstep theme of #6.

Part of #6

[devantler]

🤖 Generated by the Daily AI Engineer

@codex review

[devantler]

🤖 Generated by the Daily AI Engineer

Readiness evidence at head 0c54311e

Programmatically tested. Validate Scaffold, Platform Admissibility and CI - Required Checks are all green. The change is comment-only, proven mechanically rather than by eye: the diff of both touched files contains zero non-comment lines (git diff | grep -vE '^[+-] *#' is empty), and kubectl kustomize strips comments, so the rendered deploy/ output is necessarily byte-identical. The workflow still parses (yq -e '.jobs.admissibility.name' → Platform Admissibility).

Tried and evaluated as a user. This change has no exercisable runtime surface — it is prose a tenant author reads — so the evaluation was to check whether the new prose is true against the live platform, which is exactly what the old prose got wrong. Both corrected claims were verified independently against devantler-tech/platform main, not taken from the review that prompted them:

• add-default-deny.yaml has three generate rules — generate-default-deny, generate-allow-dns, generate-default-deny-networkpolicy — confirming a plain networking.k8s.io/v1 NetworkPolicy lands alongside the two CiliumNetworkPolicies.
• Enumerating the kind of every policy in the applied cluster-policies/ set returns two non-ClusterPolicy resources: verify-app-images and verify-ksail-images, both ImageValidatingPolicy. So the old comment's "a future CEL ValidatingPolicy" was false at the time it was read, and verify-app-images is Deny-mode over every ghcr.io/devantler-tech/* tenant image.

I also re-verified the scaffold's other policy citations while here (validate-replica-floor, validate-replica-ceiling, require-seccomp-profile, add-security-context, validate-pdb-drain-safe, restrict-tenant-secret-stores) — all still accurate as to name, enforcement mode and behaviour, so they are deliberately untouched.

Scope note. A third stale citation found in the same audit is platform-side (docs/TENANTS.md still points publish-app.yaml at the archived reusable-workflows repo) and is filed separately as devantler-tech/platform#2694 rather than pulled into this repo's PR.

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. 🚀

Reviewed commit: 0c54311eb6

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".