Retire the completed Backstage retirement fence and its one-shot tooling #5159

🤖 Generated by the Agentic Engineer

Evidence and problem

The Backstage portal retirement finished on 18 October: run 39161262289 reported the terminal completion receipt, and #5042 closed as completed. The completion step removes the platform.devantler.tech/backstage-retirement journal annotation from the backstage namespace, by design.

The restrict-backstage-retirement ClusterPolicy only acts while that journal exists. Its five rules all have the precondition retirement.present, which is true only when the namespace carries the journal, or when the namespace lookup is malformed. A read-only production check on 21 October 00:5x UTC found the backstage namespace present (it still holds the retained database) with no journal annotation. So none of the five rules can currently fire. The policy, its 18 Kyverno CLI test directories and the one-shot tooling that wrote and cleared the journal now protect nothing:

• workflows retire-backstage-stateless, complete-backstage-retirement, check-backstage-retirement, assess-backstage-retirement, the terminal-state handoff in .github/actions/deploy-prod, and their scripts/ programs;
• the scripts/retire-backstage-stateless/poller-native test module, which is the source of all 21 open Dependabot alerts (Close the 21 Dependabot alerts in the retirement proof's Go module #5047).

This matters now because Kyverno 1.20 removes ClusterPolicy (#4984). #4996 must either migrate this policy, the most complex of its ten, with five rules, namespace lookups and requester-identity checks, or remove it. Migrating rules that cannot fire adds test and review cost and protects nothing.

Decision

Remove it; do not migrate it. #4996 drops restrict-backstage-retirement from its migration list and depends on this issue instead.

Scope

• Remove the policy, its kustomization entry and its tests/restrict-backstage-retirement-* directories.
• Remove the stateless-retirement, completion, check and assessment workflows, the deploy-prod terminal-state handoff, and the scripts and Go modules that only they use, including poller-native.
• Update AGENTS.md, docs/developer-platform.md, the dependency-update config and scripts/go-vulnerability-modules.tsv. Mark docs/adr/backstage-retirement-lifecycle.md as completed, but do not delete the decision record.
• Out of scope: the retained database (k8s/providers/hetzner/apps/retained-backstage-db), the storage protection in protect-backstage-storage and internal/portalstorage, and any data decision. These stay until Establish backup and recovery acceptance for the retired portal #5122 decides the retained data.

Acceptance criteria

• Before removal, a fresh read-only check confirms that the journal is still absent and the retained database is still healthy (2 of 2, both volumes Bound).
• Every removed file is used only by the completed retirement. Each remaining reference to backstage on main is listed with a reason to keep it.
• kyverno test ./tests, the fixture-evaluation script, the Go build and tests, and the layer builds pass. CI is green.
• After deployment, a read-only check confirms the ClusterPolicy is gone, the retained database is unchanged (same UIDs, 2 of 2, volumes Bound) and production health is OK.
• Close the 21 Dependabot alerts in the retirement proof's Go module #5047's alerts close because the module is gone. Migrate the workload, Flux and provider validation ClusterPolicies to ValidatingPolicy #4996's list no longer includes this policy.