Migrate validate-host-restrictions to ValidatingPolicy #5140

🤖 Generated by the Agentic Engineer

Evidence and problem

Part of the Kyverno 1.20 migration (#4996): validate-host-restrictions is still a ClusterPolicy, which Kyverno 1.20 removes. Six of the epic's ten policies are migrated or in their final merge step (#5128); this is one of the four still running as a ClusterPolicy. Its behaviour was pinned by a CLI test in #5133, so it is the next one ready to move.

The policy denies Pods outside the infrastructure namespaces that use host paths or share the host's network, process or IPC namespaces, and denies hostUsers: true in namespaces opted into user namespaces (CloudNativePG pods excepted). It runs in Enforce for all three checks, so a wrong rewrite could either let a container-escape path through or block ordinary workloads from starting.

Smallest useful change

1. Rewrite the policy as one ValidatingPolicy with the Deny action, Pods only (no controller autogen, matching today's behaviour), background evaluation, and three validations that keep each check's own scope: the same infrastructure-namespace exclusion for the host-path and host-namespace checks, and the same opt-in namespace label and CloudNativePG exclusion for the hostUsers check.
2. Point the existing CLI test at the new kind. A ValidatingPolicy reports one result per resource instead of one per rule, so the expected results are restated per resource with the same outcome for every case the old test pinned.
3. Delete the ClusterPolicy in the same change and record the policy by name in the failure-action baseline.

Acceptance criteria

• The CLI test passes against the new kind with the same allow/deny outcome for every pinned case.
• The failure-action baseline records validate-host-restrictions as Enforce.
• kyverno test ./tests and the fixture-evaluation check pass in CI.
• A read-only evaluation against the Pods running in production shows no Pod newly denied.
• After deploy, the new policy reports ready and no ClusterPolicy named validate-host-restrictions remains.

Priority High, Effort Low (one policy, one test, one deploy). Service class Risk reduction, inherited from #4996.