Handle policy reports after their workload has disappeared #5589

🤖 Generated by the Agentic Engineer

Problem and impact

Policy Reporter treats an ownership lookup for an already deleted workload as an operational failure. Normal report delivery can race with Pod, Job or ReplicaSet deletion. The report must remain available when ownership can no longer be established, while genuine API and authorization failures must remain visible.

The public source in v3.11.1 logs every resource lookup error at Error severity and conservatively retains the report. The same source is unchanged in v3.11.2. Changing platform filters, excluding workload types or hiding collected logs would change coverage rather than correct this lifecycle handling. A sufficient repair therefore belongs in the upstream source; no equivalent portfolio configuration was found.

Intended outcome

Distinguish typed resource absence from genuine lookup failure without dropping policy results, weakening ownership selection or assigning old reports to replacement workloads that reuse a name.

Acceptance criteria

• Reproduce typed and wrapped NotFound for Pod, Job and apps/v1 ReplicaSet ownership lookups.
• Retain the report and a suitable lifecycle diagnostic when its scoped resource is gone; do not cache unknown ownership as a known decision.
• Keep Forbidden, Unauthorized, timeout, internal and ordinary API failures visible at Error severity.
• Preserve controlled/uncontrolled selection and report Added, Updated and Deleted behavior.
• Verify scope UID against the fetched object so name reuse cannot filter an old report using a replacement object's owner.
• Validate the exact proposed upstream head with its tests and required checks; keep internal review evidence private and follow the target contribution policy.
• Adopt only an independently verified published artifact through the protected platform delivery path, then inspect fresh native logs and unchanged report coverage.

This is captured follow-up work. No filter, log threshold, report, runtime permission or deployed image has been changed.

Part of #2043