[justgithubaccount]

Summary

• parse the Kustomize multi-document YAML stream and evaluate the existing Rego policies against every Kubernetes resource
• fail closed when the stream is empty, a resource is not a Kubernetes object, or OPA returns missing/malformed output
• make policy violations and validation/runtime failures return distinct non-zero statuses
• add a regression test proving a violation in document 2 fails validation
• trigger the workflow for validator changes under scripts/**
• keep the rendered Kubernetes desired state and policy definitions unchanged

Relates to justgithubaccount/app-poly-gitops-infra#27.

Validation

• python tests/test_opa_multidoc.py -v — 5 test groups passed, covering the negative document-2 case, empty streams/objects, invalid object shapes, empty separators, and malformed OPA results
• opa check policies — passed
• existing release, chat, CrewAI, dev, Vector and networking contract tests — passed
• kubectl kustomize clusters/{dev,smoke} + strict kubeconform — passed
• per-resource OPA validation — 18 dev and 5 smoke resources passed
• pre/post Kustomize renders are byte-identical:
  • dev: e97f127ba4893e3f1e3650f9990621394179cceb59934b28dc059221e03f6b2c
  • smoke: 479edc2b4fc4e90477ac0001a6ced7045c4b268824686c9a6ca66f520f410312
• actionlint .github/workflows/validate.yaml — passed

Boundaries

No policy, manifest, cluster, release or deployment changes. This PR only changes offline/CI validation.