test(ci): exercise tenant SecretStore admission

[devantler]

🤖 Generated by the Daily AI Engineer

Why

The template promises tenant manifests that are admissible on the live platform, but its policy-set smoke check did not model the namespace labels or reconciliation identity used by the high-severity SecretStore isolation rule. Unrelated policy passes could therefore leave that boundary untested.

What

• model a KSail-managed tenant namespace and tenant reconciliation service account in the offline Kyverno evaluation;
• isolate the live restrict-tenant-secret-stores ExternalSecret rule so aggregate results cannot mask it;
• prove the scaffolded namespaced store passes, a ClusterSecretStore mutation is denied, and the unmanaged-namespace and platform-reconciler carve-outs remain intentional;
• fail closed when any context, named rule, mutation, denial assertion, or boundary control is removed.

Fixes #84
Part of #6

[devantler]

🤖 Generated by the Daily AI Engineer

Readiness evidence at 0cb4ee2859e0fbe8d9ad1701b8373b40af482638

Programmatic validation

• RED reproduction on current platform policy main: the ClusterSecretStore mutant under the existing context-free invocation exited 0 with fail: 0; supplying managed-namespace Values and tenant UserInfo made the same mutant exit 1 with fail: 1.
• The embedded workflow contract passes with eight ablations covering removed namespace context, Values flag, UserInfo, named policy, named rule, security mutation, denial assertion, and both boundary controls.
• kubectl kustomize deploy/ passes.
• scripts/rename-placeholders.test.sh passes its end-to-end scaffold/onboarding controls.
• scripts/agent-instructions.test.sh passes its happy path plus ten safety mutations.
• Actionlint passes all workflows with ShellCheck integration.
• Zizmor reports no findings for the changed workflow.

User evaluation

I ran the pinned Kyverno CLI v1.18.2 Linux artifact against the rendered scaffold and the live platform policy set in a disposable Docker environment:

Admission case	Exit	Kyverno result	Evaluation
Valid namespaced SecretStore, KSail-managed namespace, tenant service account	0	pass 1 / fail 0	expected valid tenant request accepted
ClusterSecretStore mutant, same tenant context	1	pass 0 / fail 1	expected policy restrict-tenant-secret-stores / rule externalsecret-no-clustersecretstore denial
Same mutant in an unmanaged namespace	0	all zero / no match	intended policy scope preserved
Same mutant applied by flux-system/kustomize-controller	0	all zero / excluded	intended platform carve-out preserved

The PR remains draft while exact-head GitHub checks and an exact-head reviewer artifact complete.

[devantler]

🤖 Generated by the Daily AI Engineer

@codex review

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Can't wait for the next one!

Reviewed commit: 0cb4ee2859

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".