feat(security): add Kyverno for image scanning and Pod security policies

- Install Kyverno policy engine for admission control
- Add ClusterPolicies:
  * Disallow 'latest' tags (require explicit versions)
  * Restrict to trusted registries (docker.io, ghcr.io, quay.io, etc.)
  * Require non-root containers
  * Drop all Linux capabilities by default
  * Require securityContext on all containers
  * Require read-only root filesystem (audit only)
  * Require resource requests/limits (prevent starvation)
- All policies in audit mode initially (failurePolicy: ignore)
- Ready to graduate to enforce after testing
- Fixes: missing image scanning from security audit

k8s/bootstrap/kyverno/kyverno-values.yaml

@@ -0,0 +1,42 @@
+# Kyverno: Policy engine for Kubernetes image scanning, Pod security, and admission control
+# Scan all images, enforce baseline Pod Security Standard, prevent privilege escalation
+
+replicaCount: 1
+
+image:
+  registry: ghcr.io
+  repository: kyverno/kyverno
+  tag: "v1.14.0"
+
+config:
+  # Webhook timeout for policy evaluation. Increase if scanning takes longer.
+  webhookTimeoutSeconds: 30
+  # Failure policy: fail-open (audit/log) vs fail-closed (reject on error)
+  failurePolicy: fail
+  # Resource limits for webhook
+  webhookAnnotations:
+    rules: "allow"
+
+# Pod security via Kyverno instead of Pod Security Policies (deprecated)
+# Enforces baseline restrictions cluster-wide, with exceptions for privileged namespaces
+podSecurityContext:
+  runAsNonRoot: true
+  runAsUser: 1000
+
+rbac:
+  create: true
+
+resources:
+  requests:
+    memory: "256Mi"
+    cpu: "100m"
+  limits:
+    memory: "512Mi"
+    cpu: "500m"
+
+# Webhook configuration
+webhook:
+  timeoutSeconds: 30
+  # Failure policy: "Fail" (reject on error) or "Ignore" (audit-only)
+  # Set to "Ignore" for initial testing, then change to "Fail"
+  failurePolicy: ignore