security(kubescape): scope the controller baseline-context rules to Coroot-generated workloads, default off #4006

🤖 Generated by the Agentic Engineer

Evidence

The six C-0211 residual workloads in observability are the Coroot operator's own templates, and all six carry app.kubernetes.io/managed-by: coroot-operator (read live 2026-09-21). The rest of that namespace (the operator itself, the audit-log forwarder, the crossplane sync exporter) is Helm- or Git-managed and doesn't carry it. The existing controller rules can only be switched on for a whole namespace.

Audience and problem

#3990 needs a mutation that reaches only the Coroot-generated controllers. Without a narrower scope, activation would also roll every Helm and Git workload in the namespace.

Change

Add a separate, default-off baseline-context-coroot namespace label that makes the existing controller rules match only Deployments, StatefulSets and DaemonSets carrying the Coroot managed-by label. Nothing carries the new label, so this changes nothing in the cluster.

Acceptance criteria

• The rules match an operator-generated Deployment and DaemonSet in a scoped namespace, and keep privilege fields untouched.
• They don't match a non-operator workload in the scoped namespace, or an operator workload in an unscoped one.
• An inventory pin fails if any namespace carries the new label without a test change.

Size: S. Part of #3990.