Enforce flip breaks ALL app TLS: disallow-unmanaged-secrets blocks cert-managers issuance temp secrets (wildcard-plat-tls-<rand>) #91

Summary

The Kyverno Audit→Enforce flip (#42/#43, plat/gitops#14) silently breaks HTTPS for every app: disallow-unmanaged-secrets blocks cert-manager's TLS issuance temporaries (wildcard-plat-tls-<random>) because the allowlist only had the exact final name wildcard-plat-tls. cert-manager can't finish issuing → no cert → traefik 404s every app ingress.

Fixed in plat/gitops (fix/enforce-cert-manager-tls-temp-secrets, merged): allowlist glob wildcard-plat-tls*. Validated live on the product-garden.com granddaughter (app served 200 after the fix). This issue tracks the durable lesson + the gate gap.

Why nothing caught it

• The F1 fix in PR #14 allowlisted the final secret but not cert-manager's per-issuance temp secrets.
• It only manifests under Enforce (Audit just warns) AND only when a real app actually issues a TLS cert — the k3d coldstart gate germinates a platform but does not stand up a full crew-built app with a DB + public TLS, so it never exercises this path.

Follow-up

• [ ] ENFORCE.md pre-flight: add "deploy a real app (DB + TLS) under Enforce and confirm it serves 200" to the checklist (today it tests rejections + the webhook-kill, not the app issuance path).
• [ ] Audit the rest of the allowlist for other cert-manager-issued secrets that need glob coverage (e.g. is plat-local-ca-tls ever cert-manager-issued per app-ns?).
• [ ] Related: the same "gate only runs on k3d" blind spot as #89.