Define the expected Kubescape result set per surface and fail on missing or stale results #4262

🤖 Generated by the Agentic Engineer

Problem

#3156 cannot be closed because there is no agreed answer to "complete coverage of what?". The 2026-08-15 and 2026-08-22 production checks both reported coverage against ad-hoc counts, and those counts disagree: roughly 286 active containers against 138 vulnerability summaries, for example. Nothing fails when a result object goes missing or goes stale, so a coverage gap stays invisible until someone surveys by hand.

Expected outcome

The expected set of objects for each Kubescape surface is written down once. A read-only check compares the live result objects against that set and fails loudly when a result is missing or stale.

Acceptance criteria

• The expected set is defined per surface, including which namespaces and workload kinds are in scope and why any are excluded:
  • posture: controls
  • vulnerability: long-lived containers, keyed by image identity rather than by container count
  • runtime: active ReplicaSets and their profile pairs
• The definition matches the repository's 95% posture floor, so the live figure and the CI gate measure the same thing. Neither signal is weakened.
• A read-only check reports the missing and stale results for each surface. A missing or stale result is a failure, and an empty read is UNKNOWN, never clean.
• A negative control shows that the check fails when one expected result is removed.

Part of #3156.