Migrate validate-replica-floor to ValidatingPolicy #5120

🤖 Generated by the Agentic Engineer

Evidence and problem

Part of the Kyverno 1.20 migration (#4996): validate-replica-floor is still a ClusterPolicy, which Kyverno 1.20 removes. It flags Deployments and StatefulSets running fewer than 2 replicas, so their drain-safe disruption budgets actually keep one pod serving through a node drain (#1882). Its behaviour is pinned by an existing CLI test, which covers only Deployments and explicit replica counts.

Smallest useful change

Extend the CLI test with an unset replica count, a scaled-to-zero Deployment and StatefulSets, prove it against the ClusterPolicy, then rewrite the policy as a ValidatingPolicy with the same Audit action and the same exemptions (the opt-out label on the workload or its pod template, the exempt namespaces, Flagger primaries and the named single-replica components), and delete the ClusterPolicy in the same change. Record it by name in the failure-action baseline.

Acceptance criteria

• The extended CLI test passes with identical per-resource outcomes against both kinds.
• The failure-action baseline records validate-replica-floor as Audit.
• Evaluated against production's live Deployments and StatefulSets (read-only), the new policy reports the same outcome as the old one.
• After deploy, the new policy reports ready and no ClusterPolicy of that name remains.

Priority High, Effort Low (one policy, one deploy). Service class Risk reduction, inherited from #4996.