feat(policy): add default-off recommended workload labels #94

🤖 Generated by the Daily AI Engineer

Evidence and audience

The shared kyverno-policies catalog now ships a reviewed recommended-label mutation policy at immutable merge SHA 752a288171a6a26331e0a33ac18132ead0718cd3, while the Platform template still lacks that portable baseline. Template consumers need a safe opt-in that improves workload identity without changing existing scaffold renders.

Hypothesis and success signal

A default-off, single-policy import will let new platform instances trial admission-time recommended workload labels without duplicating catalog objects or changing any existing provider output. Success is exact byte parity for every default render and one structurally verified policy in explicit opt-in renders.

Smallest useful change

• Import only the reviewed raw add-recommended-labels policy at SHA 752a288171a6a26331e0a33ac18132ead0718cd3; never import the catalog root.
• Expose it through a clearly named default-off component or selector.
• Prove all existing provider and cluster renders remain unchanged by default.
• Prove opt-in renders exactly one policy with background: false, the reviewed apps/v1 Deployment/StatefulSet/DaemonSet scope, system-namespace exclusions, safe-name preconditions, and additive label patches.
• Add adversarial controls for accidental default activation, mutable or unpinned sources, duplicate catalog imports, and policy-shape drift.
• Document how an instance opts in.

Guardrails

No existing author-provided label may be overwritten. No live cluster is started; validation is static only.

Size: S