docs(kyverno): policy-reports.md says system-namespace reports are written at admission; nothing writes them #4229

🤖 Generated by the Agentic Engineer

Evidence

docs/policy-reports.md says reports in the kube-system, kube-public, kube-node-lease and kyverno namespaces "are written at admission and never refreshed". Read-only on prod, 2026-09-27: all 64 reports in those namespaces date from 2026-06-17, and 56 kube-system pods created since have no report at all, so nothing writes there. A kind proof run on #4227 also showed that a Kyverno DeletingPolicy cannot delete reports there either: the cleanup controller skips the same namespaces.

Problem

Anyone reading the docs or the dashboard concludes these namespaces are checked. The investigation in #3155 was misled by exactly this.

Acceptance criteria

• The docs state that these namespaces are not evaluated at admission, in background scans or by the cleanup controller, and that their reports are stale snapshots.
• The kind proof fails if a kube-system resource a policy matches ever gets a report, so the docs cannot go silently wrong.