Migrate disallow-latest-tag to ValidatingPolicy #5115

🤖 Generated by the Agentic Engineer

Evidence and problem

Part of the Kyverno 1.20 migration (#4996): disallow-latest-tag is still a ClusterPolicy, which Kyverno 1.20 removes. It is one of the four policies on that list with no Kyverno CLI test, so nothing pins its behaviour across a rewrite today.

The policy keeps what runs reproducible: every container image must carry a tag, and the mutable :latest tag is refused. It runs in Audit, on Pod creation, outside the infrastructure namespaces that run third-party system charts.

Smallest useful change

1. Add a Kyverno CLI test that pins today's behaviour and see it pass against the ClusterPolicy: a tagged image passes, a tagless image fails, :latest fails (for containers, init containers and ephemeral containers), a tag-plus-digest reference passes, and a Pod in an excluded namespace is skipped.
2. Rewrite the policy as a ValidatingPolicy with the same Audit action, Pod CREATE scope, background evaluation and namespace exclusions, and delete the ClusterPolicy in the same change.
3. Record the policy by name in the failure-action baseline.

Acceptance criteria

• The new CLI test passes against the ClusterPolicy before the rewrite, and passes unchanged in its expected results against the new kind.
• The failure-action baseline records disallow-latest-tag as Audit.
• kyverno test ./tests and the fixture-evaluation check pass in CI.
• After deploy, the new policy reports ready and no ClusterPolicy named disallow-latest-tag remains.

Priority High, Effort Low (one policy, one test, one deploy). Service class Risk reduction, inherited from #4996.