Raise scaffolded security posture to the platform's current baseline (CiliumNetworkPolicy + policy set)

[devantler]

🤖 Generated by the Daily AI Engineer

Problem. The template scaffolds vanilla NetworkPolicy and a smaller Kyverno policy set, while the reference platform has standardized on CiliumNetworkPolicy everywhere and added further cluster policies (disallow-latest-tag, image verification, replica floor/ceiling, PDB drain-safety, recommended labels) plus a scoped security-exceptions framework. Fresh platforms start with yesterday's posture.

Proposed direction. Port the platform's network-policy standard and the generic subset of its additional cluster policies (org-specific image-verification and exceptions stay out or ship genericized/default-off), keeping the template bootstrap-able out of the box.

Rough size. L

Part of #24

[devantler]

🤖 Generated by the Daily AI Engineer

Decomposed the first portable security-policy slice as devantler-tech/kyverno-policies#20 and linked it as this issue's sub-issue.

Live revalidation at Platform Template main (15646e9) found 32 CiliumNetworkPolicy resources and zero vanilla NetworkPolicy resources, so that half of the original premise is already satisfied. The first remaining gap is the reference platform's image-tag audit. Its reusable behavior will land and be tested once in the shared catalog; consumer-specific exclusions and rollout remain here. The catalog policy is deliberately inert until a separate pinned Platform Template adoption change.

[devantler]

🤖 Generated by the Daily AI Engineer (Codex instance)

The shared catalog slice is delivered: devantler-tech/kyverno-policies#21 merged as verified commit ffff4f152f3efd940cc78d56d257925592409ce1, and its main CI plus CodeQL are green.

This keeps the catalog inert by design. The next increment on this parent is the separate Platform Template adoption: pin that immutable revision, select only disallow-latest-tag, preserve Audit/no shared exclusions, remove any duplicated local policy identity, and prove the rendered template contains exactly one policy.

[devantler]

🤖 Generated by the Daily AI Engineer (Codex instance)

Delivery child #84 is complete via #85 (cde05878304d77df263679ca17653dc25ff7573b). Platform Template now selects only the immutable shared disallow-latest-tag policy, without importing the catalog root or duplicating local policy identities.

Both Docker/local and Hetzner/prod provider renders contain exactly one identical policy with two Audit rules and no exclusions. Both KSail workload validations, naming, observability-option, required CI, CodeQL, and exact-head review passed.

This closes the reusable-policy adoption slice; parent #67 remains open for its remaining security-baseline work.

[devantler]

🤖 Generated by the Daily AI Engineer (Codex instance)

Delivery child #94 is complete via #95 (26ca5aece22b958cc4de0ff0c90b0ccd51fcc1a0). Platform Template now offers explicit local/prod profiles for the immutable shared add-recommended-labels policy while every default provider and cluster render remains unchanged.

The CI gate pins the exact mutation contract and rejects mutable or duplicate sources, broadened workload scope, author-label overwrites, removed namespace exclusions, and weakened name guards. The operator guide now covers selection, the required push/update/reconcile activation sequence, and rollback. Parent #67 remains open for its remaining baseline slices.