Refuse typed Tenant sources omitted by raw consumer discovery #5309

🤖 Generated by the Agentic Engineer

Summary

Close the raw source-discovery gap found while implementing #5307, part of the business-site staging prerequisite #5247.

Motivation

The existing scan selects literal publisher subjects. A kro Tenant creates its OCI source inside the controller and has no such subject, so adding it beside the complete five-consumer inventory currently returns success while omitting that source. Production conservation independently refuses current instances; it does not make the raw report/approval reader correct.

Proposed Solution

Parse production-candidate YAML/JSON structurally, join source-producing controller schemas to their instances by complete group/version/kind, and refuse instances until their full admission chain is implemented under #5307. Apply the raw inventory refusal to the report and approval guard before output/writes. Preserve ordinary consumers, foreign GVKs, contained regular manifest links and the local-only Docker boundary. Keep directory/escaping/dangling links and incomplete reads fail-closed. Do not grant positive bootstrap/binding authority or register a production Tenant in this change.

Acceptance Criteria

• Actual pre-fix report controls reproduce silent omission for block/flow YAML, JSON, quoted/escaped keys or values, aliases, multiple documents, nested carriers and alternative resource filename spellings; malformed candidate reads and unsupported links also fail closed.
• The repaired report and approval guard refuse these cases without partial consumer output. Complete controller-schema attribution preserves foreign group/version peers; existing legacy/dual-publisher behavior and local-only controls pass.
• The complete new suite and script checks run in the required CI path; existing generator, writer and conservation suites remain green.
• Current-head substantive review, protected merge and merged-source verification complete. Admit business-site publication for source-only staging #5307/Register the public-only business-site staging tenant #5247 stay open; no workload, route, customer identity, private input or portal activation is claimed.

Alternatives Considered

A textual kind grep misses valid YAML/JSON spellings. A partial positive projection would grant an admission interface before generator, rendered-constructor and observed-state controls are integrated. This delivery refuses explicitly and leaves that coherent integration in #5307.