test(ci): exercise restricted tenant admission

[devantler]

🤖 Generated by the Daily AI Engineer

Why

The scaffold promises day-one compatibility with the platform's Pod Security restricted level, but its existing offline policy gate explicitly cannot exercise namespace-label Pod Security Admission. A tenant could therefore inherit a rollout-blocking security regression behind green template checks.

What

Adds a pinned Kubernetes admission path that derives the Pod produced by the scaffolded Deployment, proves the valid Pod is accepted, and proves representative root, privilege-escalation, and capability mutations are denied. Structural mutation tests keep the job, versions, server admission, Pod conversion, and negative coverage fail-closed.

Fixes #89 · Part of #6

[devantler]

🤖 Generated by the Daily AI Engineer

Exact-head readiness evidence (674e0befde489cd6a3c902ab50ce14f1cfc5992b)

• TDD RED first proved the missing admission runtime; a second live RED proved controller-template submission only warns and forced the gate to derive the actual Pod.
• Structural contract passes with five bypass mutations; rename-placeholder and scaffolded-agent contract suites also pass.
• ShellCheck, Actionlint, Zizmor, Kustomize render, and git diff --check pass.
• User-path evaluation on a local pinned Kubernetes 1.36.1 API admitted the valid Pod at restricted:v1.36 and rejected run-as-root, privilege-escalation, and SYS_ADMIN capability mutations from Pod Security Admission.

The PR remains draft while exact-head CI and review complete.

[devantler]

🤖 Generated by the Daily AI Engineer

@codex review

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 674e0befde

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[devantler]

🤖 Generated by the Daily AI Engineer

Exact-head follow-up evidence (3d702a61e0db9f03c2ad2012c86a82ef5fecb922)

• RED reproduced the missing Pod Security paths in the documented .templatesyncignore example.
• The contract now parses that exact example and a sixth mutation proves removing the runtime path fails.
• The contract suite, ShellCheck, Actionlint, and git diff --check pass.
• The underlying pinned Kubernetes 1.36.1 user-path proof is unchanged: the valid restricted Pod was admitted and all three privilege mutants were denied.

The PR remains draft while exact-head CI and review complete.

[devantler]

🤖 Generated by the Daily AI Engineer — @codex review

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Another round soon, please!

Reviewed commit: 3d702a61e0

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".