Migrate restrict-arc-openbao-certificate to ValidatingPolicy #5123

🤖 Generated by the Agentic Engineer

Evidence and problem

Part of the Kyverno 1.20 migration (#4996): restrict-arc-openbao-certificate is still a ClusterPolicy, which Kyverno 1.20 removes. It blocks any namespace other than openbao from obtaining a certificate from the cluster-wide CA that signs OpenBao's transport certificate, which would otherwise let that namespace impersonate OpenBao. It is one of the few blocking (Enforce) rules in the set, so the replacement must keep blocking with no gap.

Smallest useful change

Extend the existing CLI test with same-named namespaced issuers (explicit and by default), prove it against the ClusterPolicy, then rewrite the policy as a ValidatingPolicy that denies with the same scope, and delete the ClusterPolicy in the same change. Record it by name in the failure-action baseline as Enforce.

Acceptance criteria

• The extended CLI test passes with identical per-resource outcomes against both kinds.
• The failure-action baseline records restrict-arc-openbao-certificate as Enforce.
• Evaluated against production's live Certificates and CertificateRequests (read-only), the new policy reports the same outcome as the old one.
• After deploy, the new policy reports ready and no ClusterPolicy of that name remains.

Priority High, Effort Low (one policy, one deploy). Service class Risk reduction, inherited from #4996.