S17 phase2-cncf-conformance: K8s AI conformance + supply-chain CI rows

[Pal Lakatos-Toth (pallakatos)]

Brings AzureClaw to CNCF Kubernetes AI Conformance v1.35+ minimum bar, and pins two new permanent supply-chain CI rows so that neither can be silently dropped.

Surveyed gaps

• ClawPairing lacked a status.conditions[] array (criterion C3) and any CEL validation rule (C5).
• Six of eight CRDs (a2aagent / claweval / clawmemory / inferencepolicy / mcpserver / toolpolicy) lacked the recommended app.kubernetes.io/name label (C10).
• The operator namespace azureclaw-system had no default-deny NetworkPolicy (C8).
• cargo-audit ran with continue-on-error: true; no cargo-deny step; no cosign-verify recipe in CI (C14).

Additions

• Conformance gap-fixes: added ClawPairing.status.conditions[] + Ready printer column + two CEL rules; added recommended labels to all split-file CRDs; added operator-default-deny-networkpolicy.yaml template (empty podSelector, both policyTypes, allow-list for kube-DNS / kube-apiserver / Prometheus :9091).
• tests/cncf-conformance/ workspace crate — 15 criteria, 17 cargo test cases, binary writes CONFORMANCE-REPORT.md and exits non-zero on failure. Suite renders the helm chart with helm template ac deploy/helm/azureclaw --namespace azureclaw-system.
• deny.toml at workspace root — advisories / licenses / bans / sources, with two documented advisory exceptions (RUSTSEC-2024-0370 unmaintained proc-macro-error via sigstore; RUSTSEC-2023-0071 rsa Marvin via jsonwebtoken/sigstore — neither call site does attacker-observable RSA decryption).

New permanent CI rows (.github/workflows/ci.yml)

• cargo-deny — required, runs cargo deny check.
• cosign-verify — required, pins keyless GitHub OIDC verification recipe; PR runs are dry-run with the command echoed into the run summary.

Docs

• docs/operations/supply-chain.md — image-tag convention, cosign recipe, deny.toml posture.
• docs/operations/branch-protection.md — canonical required-checks list.
• docs/api/conditions.md — per-CRD reason taxonomy (Ready / Progressing / Degraded).
• docs/security-audits/2026-04-30-phase2-cncf-conformance.md — audit narrative.
• CHANGELOG.md — ### S17 phase2-cncf-conformance entry under [Unreleased] — Phase 2.

Conformance status

15 / 15 criteria pass. Run cargo run -p azureclaw-cncf-conformance --bin cncf-conformance to regenerate tests/cncf-conformance/CONFORMANCE-REPORT.md.

ID	Criterion	Result
C1	Every CRD has a served + storage version	✅
C2	Every CRD has additional printer columns	✅
C3	Every CRD status declares a conditions[] array	✅
C4	Every CRD spec is a structural schema	✅
C5	Every CRD ships at least one CEL x-kubernetes-validations rule	✅
C6	Every CRD declares a status subresource	✅
C7	Every Deployment has liveness + readiness probes	✅
C8	Operator namespace has a default-deny NetworkPolicy	✅
C9	Every image ref declares an explicit tag or digest (no implicit :latest)	✅
C10	Every CRD carries app.kubernetes.io/name label	✅
C11	Every CRD declares a valid scope	✅
C12	Every CRD exposes a status-state printer column	✅
C13	Every Deployment runs non-root with a seccompProfile	✅
C14	ci.yml wires the supply-chain rows (cargo-deny, trivy, npm audit, cosign-verify)	✅
C15	deny.toml configures advisories/licenses/bans/sources	✅

Verification

• cargo test --all — 17 conformance + ~600 existing tests, all green.
• cargo deny check — advisories ok, bans ok, licenses ok, sources ok.
• helm lint deploy/helm/azureclaw — clean.
• cargo clippy --all-targets -- -D warnings — clean.
• cd cli && npm run lint && npm run typecheck — clean.

Notes

• The repo :latest image-tag convention is preserved; C9 was scoped to "every image declares an explicit tag or digest" (catches untagged refs only). Documented in docs/operations/supply-chain.md.
• SBOM wiring into image-cache-publish.yml and CRD doc-gen are tracked as follow-ups in the audit doc.

Co-authored-by: Copilot 223556219+Copilot@users.noreply.github.com