Let the static guards admit a reviewed MutatingPolicy shape #5096

🤖 Generated by the Agentic Engineer

Evidence and problem

Two static guards refuse any MutatingPolicy in the production render, by design, because neither can evaluate CEL mutations:

• the Crossplane egress-policy contract rule reject-cel-policy-producers (scripts/tests/crossplane-egress-policy-rules.yaml) rejects every policies.kyverno.io MutatingPolicy/GeneratingPolicy (only a policy-report DeletingPolicy is excepted, Prune stale Kyverno results after policies stop matching #2573);
• scripts/guard-consumer-discovery-conservation.sh refuses a render that holds any MutatingPolicy, MutatingAdmissionPolicy or GeneratingPolicy, because it cannot prove such a mutation preserves consumer identity.

Measured on #5095 (2026-10-19), the first mutation migration for #4997: the policy itself is correct (its CLI test passes unchanged before and after), but 🧪 Validate Manifests and 🛡️ Validate Repository Guards fail on these two refusals. So none of the eleven mutation policies in #4997 can move to MutatingPolicy before Kyverno 1.20 removes ClusterPolicy (#4984) until the guards can tell a safe mutation from an unsafe one.

Audience and outcome

The platform operator: the mutation defaults keep working across the Kyverno 1.20 upgrade, and the guards keep refusing any mutation that could strip egress policy or change a consumer's identity.

Smallest useful change

Replace each blanket refusal with an allow-list of reviewed shapes, not a list of exceptions: a MutatingPolicy passes only when its matchConstraints.resourceRules name exactly the reviewed kinds (for #5095: helm.toolkit.fluxcd.io helmreleases) and none of the carrier kinds the guards protect, and its mutations are a JSON patch limited to reviewed paths. Everything else stays refused. Each guard keeps its negative controls, plus a new one proving a MutatingPolicy on a protected kind or path is still refused.

Acceptance criteria

• Both guards admit the reviewed HelmRelease CRD-strategy MutatingPolicy from feat(kyverno): migrate helm-release-install-crds to MutatingPolicy #5095 and still refuse a MutatingPolicy on NetworkPolicy/CiliumNetworkPolicy or any other protected carrier kind.
• Negative controls for each guard prove the refusal still fires for an unreviewed shape.
• feat(kyverno): migrate helm-release-install-crds to MutatingPolicy #5095 passes CI on top of the change.

Size: medium. Blocks #4997.