security(argo-workflows): label the namespace warn/audit restricted #1719

Follow-up to #1717 / #1718 (task 8a).

The agent steps in argo-workflows now run with a restricted pod and container securityContext, but the namespace itself carries no Pod Security label, so nothing reports a new or changed workflow template that drops it.

What to do

Label argo-workflows with:

pod-security.kubernetes.io/warn: restricted
pod-security.kubernetes.io/audit: restricted

Warn and audit only. No enforce.

Acceptance

• The labels are on the namespace, managed in GitOps (not kubectl label).
• One sweep of what restricted would reject today: every template and helper step (commit-and-push, notify-telegram, post-deploy-verify, assert-*, the root clone-gitops init containers, platform workflows such as deploy-service and create-tenant), with the reason, recorded on this issue.
• A decision per violation: harden, or keep as a documented exception. Any move to enforce is a separate issue and depends on the non-root clone-gitops follow-up.

🤖 Generated with Claude Code

https://claude.ai/code/session_013zqBqP9sSbVTd1kXRLA6AU