feat(ci): validate combined Helm post-render streams - #5505

🤖 Generated by the Agentic Engineer

@coderabbitai full review

🤖 Generated by the Agentic Engineer

Validation at d9603f11f4274298469572c3bb9b14dd9675af6f:

• New controls failed before the change. The complete post-renderer and disruption-budget suites now pass with 114 and 330 assertions, including invalid hook patches, unsupported strategies, and hooks that must never satisfy a workload budget. ShellCheck, workflow lint, and whitespace checks pass.
• User evaluation used the audited Helm 4.2.4 SDK renderer and the published Kyverno 3.9.2 chart. Capturing the actual input and applying the proposed lifecycle patch changed exactly the expected Job annotation among 80 rendered resources under Kubernetes YAML semantics. No other resource or field changed.
• The refreshed main branch was merged without changing the tested guard sources. This PR enables validation only; deployment cleanup and its production acceptance remain separate under Clean up successful Kyverno migration jobs after upgrades #5491.

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

_{Comment @coderabbitai help to get the list of available commands.}

🤖 Generated by the Agentic Engineer

cr:no-gate@d9603f1 — the included review was refused; the native guard confirms no completed review of this head.

🤖 Generated by the Agentic Engineer

@codex review

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Codex Review: Didn't find any major issues. Breezy!

Reviewed commit: d9603f11f4

🤖 Generated by the Agentic Engineer

Ready for protected delivery at d9603f11f4274298469572c3bb9b14dd9675af6f: all 49 reported checks are settled without failures, every readable required gate passes, the branch is CLEAN, and there are no review threads or unresolved body findings. Codex's clean receipt 6467233791 binds this head. The real Helm user exercise and its limits are recorded above.

The configured code-quality rule has no readable per-head result, so the completeness helper reports it as UNVERIFIED; the normal protected merge API must decide that rule. This is not a complete-gate claim or an override. #5491 remains open for the separate lifecycle rollout and production acceptance.

🤖 Generated by the Agentic Engineer

The merge queue removed this PR for failed_checks at 16:16 UTC. Attempt 40722307528 failed before the application trial: public-image verification hit a GitHub API quota response and correctly refused to exceed its bounded recovery. The production deployment, final queue check and recovery jobs were all skipped.

The existing hosted fixture subsequently passed in job 122943582228, including the real controller and restricted public application step. Source head d9603f1 remains CLEAN, with its current-head Codex pass and no open review findings. No source, check, deadline or credential change is needed for this recovery. Performing one bounded requeue after that verified service recovery.