feat(observability): activate security progress dashboards in Coroot

docs/coroot-security-progress.md

@@ -70,10 +70,20 @@ metrics and route are preserved by this component.
 
 ## Deployment and maintenance
 
-The component is **off by default**: no normal overlay references it. After its validation
-and review, a separate activation adds
-`../../../bases/infrastructure/coroot/components/security-progress` to the production
-infrastructure overlay's `components`. Use the protected merge/deploy path. The
+The shared base leaves this component **off by default**. The production infrastructure
+overlay explicitly enables
+`../../../bases/infrastructure/coroot/components/security-progress` in its `components`.
+To disable collection and reconciliation, remove that production component reference
+through the protected merge/deploy path. In the same change, remove
+`Deployment/coroot-security-progress` from the Coroot budget's reviewed-unrelated list
+in `scripts/pdb-selector-exceptions.tsv`, since it no longer renders alongside the
+operator-managed Coroot server. Also remove the `ClusterRole/coroot-security-progress`
+and `ClusterRoleBinding/coroot-security-progress` entries from
+`scripts/validate-eks-ci-role-policy/approved-surface.txt`; the authorization validator
+rejects approvals for resources that no longer render. To re-enable the component,
+restore its production reference and the reviewed-unrelated entry, then review the
+rendered RBAC and restore both matching authorization fingerprints in the same
+protected change. Run the deployment validation before either transition. The
 collector needs only the explicitly listed read-only resources; only its container
 receives a projected service-account token. Exec probes check publication freshness,
 project binding and the two local services. Reporting a failed security source still

k8s/providers/hetzner/infrastructure/kustomization.yaml

@@ -204,6 +204,9 @@ components:
   # shared Coroot base because Crossplane exists only on this provider. The
   # adjacent alerter delivers stuck-resource and coverage-gap notifications.
   - ../../../bases/infrastructure/coroot/components/crossplane-sync-exporter
+  # Prod-only security progress: collect policy and scan evidence, and reconcile
+  # the three owned Coroot dashboards. Policy Reporter retains detail workflows.
+  - ../../../bases/infrastructure/coroot/components/security-progress
   # Platform-wide HelmRelease drift detection (mode: enabled). See
   # bases/components/helmrelease-drift-detection.
   - ../../../bases/components/helmrelease-drift-detection

scripts/pdb-selector-exceptions.tsv

@@ -35,4 +35,4 @@
 # satisfies, that its cluster does not render, or for a cluster that is no overlay, fails the
 # guard, so remove it then.
 prod	kube-system/coredns	external:talos	file:ksail.prod.yaml:.spec.cluster.talos.version	v1.13.11	-	Talos installs the CoreDNS Deployment from its own bootstrap manifests, so no layer of the prod cluster renders it. Pod label k8s-app=kube-dns verified in the Talos source, internal/app/machined/pkg/controllers/k8s/internal/k8stemplates/coredns.go.
-prod	observability/coroot-coroot	Coroot/observability/coroot	HelmRelease/observability/coroot-operator	0.10.6	Deployment/crossplane-sync-exporter	coroot-operator builds the coroot-coroot StatefulSet from this custom resource at runtime; its chart renders only the operator. Pod labels managed-by=coroot-operator, part-of=<resource name> and component=coroot verified in the coroot-operator source (app version v1.10.6), controller/controller.go Labels and controller/coroot.go. The crossplane-sync-exporter Deployment is this repository's own metrics exporter; it shares only the grouping label part-of=coroot.
+prod	observability/coroot-coroot	Coroot/observability/coroot	HelmRelease/observability/coroot-operator	0.10.6	Deployment/coroot-security-progress,Deployment/crossplane-sync-exporter	coroot-operator builds the coroot-coroot StatefulSet from this custom resource at runtime; its chart renders only the operator. Pod labels managed-by=coroot-operator, part-of=<resource name> and component=coroot verified in the coroot-operator source (app version v1.10.6), controller/controller.go Labels and controller/coroot.go. The coroot-security-progress collector and crossplane-sync-exporter are this repository's own separate Deployments; each shares only the grouping label part-of=coroot and lacks the managed-by=coroot-operator and component=coroot labels that this budget requires.

scripts/validate-eks-ci-role-policy/approved-surface.txt

@@ -162,6 +162,8 @@ rbac.authorization.k8s.io/v1|ClusterRoleBinding||ascoachingogvaner-external-dns
 
 rbac.authorization.k8s.io/v1|ClusterRoleBinding||cnpg-degraded-alert 51487655b693fe18c5d7196d0042e4bc8345a15b0ea3afe03216e69d37905940
 
+rbac.authorization.k8s.io/v1|ClusterRoleBinding||coroot-security-progress f2180564b6200bc35eebe9d814c8cad1d38f5f2fb6323322659a73441ad86aa5
+
 rbac.authorization.k8s.io/v1|ClusterRoleBinding||crossplane-provider-unhealthy-alert 1cc87f7bfd2b06426b26df11488ceb00e9a22e749bfca05814c1c9a0edc7be9a
 
 rbac.authorization.k8s.io/v1|ClusterRoleBinding||crossplane-sync-alerter 2ff039b4399f755bb15112771e2586ac05d68b113313824972720f4a6e156147
@@ -210,6 +212,8 @@ rbac.authorization.k8s.io/v1|ClusterRole||cnpg-degraded-alert 42c958c00b28103b38
 
 rbac.authorization.k8s.io/v1|ClusterRole||cnpg-tenant-edit 942ba69a066888eb7a82444a29f3917aa8c836c0bb800cee159e4e3bda4e3974
 
+rbac.authorization.k8s.io/v1|ClusterRole||coroot-security-progress eca07a4b13c08811b86ad738681fa9ca315c6d798380c86d6449b74507213832
+
 rbac.authorization.k8s.io/v1|ClusterRole||crossplane-provider-unhealthy-alert 6a8845e6cd798bea6c9dd0353f5ac34dc93e3f2ccdda4e4d92288705e0dc6a45
 
 rbac.authorization.k8s.io/v1|ClusterRole||crossplane-sync-alerter faf47ab2d737acd58c26bbf7aa3b46f23e5b22fc52aed6acd0fcf7f434fc431f