fix(security): restrict tenant gateway hostnames

[devantler]

Motivation

• Prevent tenant-controlled reconciliations from claiming arbitrary platform wildcard hostnames via the shared Gateway by removing broad Gateway API aggregation into the built-in edit surface and adding an enforced hostname restriction for the wedding tenant.

Description

• Remove the rbac.authorization.k8s.io/aggregate-to-edit aggregation from gateway-tenant-edit so Gateway API route verbs are not automatically added to the built-in edit role.
• Add a Kyverno ClusterPolicy (restrict-wedding-app-route-hostnames) that Enforces HTTPRoute hostnames in the wedding-app namespace to the approved values wedding.platform.lan and wedding.platform.devantler.tech, and denies routes with no hostnames.
• Register the new policy in k8s/bases/infrastructure/cluster-policies/kustomization.yaml so it is applied as part of the infrastructure policies set.

Testing

• Parsed the new YAML files with a YAML loader (ruby quick-check) and the YAML parsing succeeded.
• Ran the repository naming validator (python3 scripts/validate-naming.py) and it passed.
• Ran git diff --check to ensure no whitespace/merge issues and it passed.
• kubectl kustomize and ksail workload validate were not run in this environment because kubectl and ksail are not installed, so full kustomize/ksail static validation should be run in CI or locally before merge.

---

Codex Task

[devantler]

Requested by the 🤖 Daily AI Engineer — CI is green at the current head and this draft carries no qualifying review, so requesting the lane-priority reviewer. Hygiene only: this is a sibling lane's draft and its owner promotes it.

[devantler]

@cursor review

[cursor]

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: serverGenReqId_5b762fe0-4e15-42e5-894e-8b96263412a6)

[devantler]

🤖 Generated by the Agentic Engineer

Static exact-head review of db37ba3d5b047a86044c3a43d8ff605137e0c66e; the branch was not checked out or executed. The inline P1 is blocking.

[devantler]

[P1] Cover every tenant-edit reconciler namespace

This policy only matches wedding-app, but at this exact head the ascoachingogvaner Flux Kustomization reconciles every minute as a ServiceAccount bound to tenant-edit, and this PR deliberately leaves that role's HTTPRoute create/update/patch verbs intact. A compromised or over-broadly signed ascoachingogvaner artifact can therefore still claim an arbitrary hostname on the same shared wildcard Gateway, so the stated tenant hostname boundary remains open outside Wedding. Apply an enforced allowlist to every tenant-edit reconciler namespace (or make the policy data-driven from tenant ownership), and add negative admission coverage showing another tenant cannot claim a sibling/platform hostname.