Manual CD chart validation fails because Kyverno CLI is missing #4312

🤖 Generated by the Agentic Engineer

Manual CD cannot reach deployment because its isolated chart namespace check invokes the Kyverno CLI without installing it in that job. Run 36831110585, on the merged main commit, failed with kyverno: command not found. The equivalent CI and recovery jobs install the chart-matched CLI before this check.

Install the same pinned CLI in manual CD before chart admission validation, preserving every authorization gate. Validate the workflow and existing contracts, then run manual CD successfully from the merged revision.

Acceptance: manual CD executes the real chart admission and production authorization checks, reaches deployment, and completes its requested post-deployment verification. No gate is skipped or weakened.