CI validates policies with an older Kyverno engine than the declared chart #3631

🤖 Generated by the Agentic Engineer

Platform's two Kyverno CLI installation steps in .github/workflows/ci.yaml still use 1.18.2, while the declared Kyverno Helm chart 3.9.0 has appVersion: v1.19.0. The workflow comment incorrectly claims the versions match. Those unannotated action inputs are outside the existing CLI-version update manager, allowing policy validation to stay on an older engine after a chart update.

This weakens the operator's confidence that passing policy fixtures predict the engine used by the declared platform. Discovered during #3630 rollout verification; its complete 280-case suite and focused RBAC gate pass under both 1.18.2 and 1.19.0, so no behavior difference is currently observed.

Acceptance:

• Both CI install sites use 1.19.0 through one declared version value.
• The existing dependency-update mechanism tracks that value and coordinates Kyverno chart/CLI update proposals.
• Stale version prose is corrected; all existing policy and workflow checks pass.
• This changes CI tooling only, without changing the deployed chart, policy actions or exceptions.