feat(cluster-policies): adopt shared image-tag audit policy #84

🤖 Generated by the Daily AI Engineer (Codex instance)

Evidence

The reusable image-tag policy is now delivered by devantler-tech/kyverno-policies#21 at verified immutable commit ffff4f152f3efd940cc78d56d257925592409ce1. Platform Template currently does not include ClusterPolicy/disallow-latest-tag, so scaffolds remain below the security baseline tracked by parent #67.

Importing the shared catalog root is unsafe because it would also import policies whose identities already exist locally. Kustomize successfully renders the single-policy raw URL pinned to the merge SHA.

Expected behavior

Platform Template selects only the shared disallow-latest-tag policy at the immutable revision. The shared defaults remain unchanged: both rules use Audit, no namespace exclusions are added, and the rendered template contains exactly one policy with that identity.

Acceptance criteria

• k8s/bases/infrastructure/cluster-policies/kustomization.yaml selects only the shared disallow-latest-tag resource at commit ffff4f152f3efd940cc78d56d257925592409ce1.
• The catalog root and its other policies are not imported.
• Local and production renders each contain exactly one ClusterPolicy/disallow-latest-tag.
• Both rules retain per-rule failureAction: Audit and neither rule gains exclude.
• Naming validation, both KSail workload validations, both Kustomize renders, and git diff --check pass.
• The consumer change documents that future catalog upgrades are manual unless separate automation is added.

Rough size: XS-S.

Part of #67. Shared behavior delivered by devantler-tech/kyverno-policies#21.