chore(ci): reproduce kyverno false-green screenshot scenario

.github/workflows/guardrails-checks.yaml

@@ -72,7 +72,7 @@ jobs:
         id: kyverno
         shell: bash
         run: |
-          set -uo pipefail
+          set -u
 
           mapfile -t app_files < <(find apps -type f \( -name '*.yaml' -o -name '*.yml' \))
           if [ ${#app_files[@]} -eq 0 ]; then
@@ -91,30 +91,9 @@ jobs:
             resource_args+=(--resource "$f")
           done
 
-          # Capture output and exit code separately.
-          # kyverno-cli apply may exit 0 even when policy violations exist; we inspect
-          # stdout as a second check to guard against the false-green described in
-          # docs/REALITY_CHECK_MILESTONE_4_GUARDRAILS.md (Failure 4).
-          set +e
           docker run --rm -v "$PWD:/work" -w /work ghcr.io/kyverno/kyverno-cli:v1.12.5 \
             apply infrastructure/kyverno/policies/*.yaml \
-            "${resource_args[@]}" 2>&1 | tee /tmp/kyverno-output.txt
-          kyverno_exit="${PIPESTATUS[0]}"
-          set -e
-
-          echo "Kyverno exit code: ${kyverno_exit}"
-
-          # Fail if kyverno returned non-zero (explicit violation)
-          # OR if output contains violation markers (guards against exit-code-0 false green).
-          if [ "${kyverno_exit}" -ne 0 ] \
-              || grep -qE "^FAIL" /tmp/kyverno-output.txt \
-              || grep -qE "fail: [1-9][0-9]*" /tmp/kyverno-output.txt; then
-            echo ""
-            echo "Kyverno policy violations detected. Failing CI."
-            exit 1
-          fi
-
-          echo "All ${#app_files[@]} app manifests passed Kyverno policy checks."
+            "${resource_args[@]}" 2>&1 | tee output.txt
 
       - name: Write job summary
         if: always()

apps/screenshot-policy-violation/deployment.yaml

@@ -0,0 +1,20 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: screenshot-policy-violation
+  namespace: default
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: screenshot-policy-violation
+  template:
+    metadata:
+      labels:
+        app: screenshot-policy-violation
+    spec:
+      containers:
+        - name: app
+          image: nginx:1.25.5
+          ports:
+            - containerPort: 80