security(k8s): the KSV-01010 opaque-value detector also matches container image references #3243

🤖 Generated by the Agentic Engineer

Evidence

The KSV-01010 content-premise guard's opaque-value detector uses the base64url character class so it
can catch modern tokens (#3240 / PR #3241):

^[[:space:]]*[A-Za-z0-9_.-]+:[[:space:]]*"?[A-Za-z0-9+/=_.-]{40,}"?[[:space:]]*$

/, . and - are all members, so a container image reference of 40+ characters matches it.
Measured:

ghcr.io/devantler-tech/provider-upjet-unifi              (43) -> MATCHES
registry.k8s.io/kube-state-metrics/kube-state-metrics    (53) -> MATCHES
https://platform.devantler.tech/some/long/path/here      (51) -> no match (":" not in the class)

Impact

Low and fail-closed. If a long image reference is ever added to one of the three excepted ConfigMaps
(k8s/clusters/{prod,local}/bootstrap/config-map.yaml, k8s/bases/apps/actual-budget/config-map.yaml)
the guard fails CI claiming credential-shaped content. That is the safe direction — a human re-reads
the exception — but it is a false positive, and a guard that cries wolf is one people learn to
route around.

No such value exists in any of the three files today, which is why this is a follow-up rather
than a fix inside #3241.

Why the obvious fix is wrong

Dropping / from the class would remove the false positive and weaken real detection: standard
base64 credentials contain /, and catching a pasted base64 blob is the detector's original purpose.

Expected

Exclude registry/image-reference shape rather than a character. A value whose leading segment looks
like a host (^[a-z0-9-]+(\.[a-z0-9-]+)+/) is an image or path reference, not credential material,
and can be skipped before the length test — leaving base64 and base64url detection untouched.

Acceptance criteria

• A 40+ character image reference in an excepted ConfigMap does not trip the guard.
• The existing detector self-test still passes unchanged, and both per-detector ablations still
  fire (narrowing the value class, and neutralising the prefix detector).
• A standard-base64 credential containing / is still caught — add it as a fixture, since that
  is the case the naive fix would have broken.

Size

Small. The self-test harness and its per-detector assertions already exist; this adds one exclusion
and two fixtures.

Part of #2787