Migrate validate-pod-security to a ValidatingPolicy #5165

🤖 Generated by the Agentic Engineer

Evidence and problem

Part of the Kyverno 1.20 migration (#4996): validate-pod-security is the last of the epic's ten policies with no migration in flight. The others are migrated, in the merge queue, or being removed (#5159). Kyverno 1.20 removes ClusterPolicy, so until this one moves the upgrade stays blocked.

The policy enforces the restricted Pod Security profile outside the infrastructure namespaces: every container must refuse privilege escalation, run as non-root, not be privileged and drop all capabilities; the pod must use a RuntimeDefault or Localhost seccomp profile; and no container may override that with another profile. It is Enforce and, unlike the policies migrated so far, it also judges controller templates (Deployment, StatefulSet, DaemonSet, Job, CronJob, ReplicaSet, ReplicationController), so a wrong rewrite could either admit an insecure workload or refuse a Flux apply. Its current decisions are pinned by a 143-resource CLI test (#5143, merged in #5144).

Smallest useful change

1. Rewrite the policy as one ValidatingPolicy with the Deny action, background evaluation, generated rules for the same seven controller kinds, the same infrastructure-namespace exclusion, and three validations with the existing messages.
2. Restate the pinned CLI tests per resource (a ValidatingPolicy reports one result per resource rather than per rule) with the same outcome for every case, and repoint the scripts and self-tests that name the old rules.
3. Delete the ClusterPolicy in the same change and record the policy by name in the failure-action baseline.

Out of scope: tightening the empty capabilities.drop case (#5149) — the rewrite keeps today's behaviour.

Acceptance criteria

• The pinned CLI test passes against the new kind with the same allow/deny/skip outcome for all 143 resources, and the provider-deployment test keeps its outcomes.
• The failure-action baseline records validate-pod-security as Enforce.
• kyverno test ./tests, the fixture-evaluation check and its self-test pass in CI.
• A read-only evaluation against production shows no workload newly denied.
• After deploy, the new policy reports ready and no ClusterPolicy named validate-pod-security remains.

Priority High, Effort Medium (one policy, three self-tests to repoint, one deploy). Service class Risk reduction, inherited from #4996.