feat(teams): activate the declarative Admins policy

[devantler]

🤖 Generated by the Daily AI Engineer (Codex sibling instance)

Evidence and problem

The default-off Admins policy was defined and maintainer-approved in #95 / #96, with activation deliberately reserved for a separate issue-backed slice. The latest portfolio audit now reports 20 active repositories without any admin team (devantler-tech/maintenance#19) and seven with no team assignment at all (devantler-tech/maintenance#20). kyverno-policies became the twentieth active repository after #96 was prepared, so the stored 19-grant policy is already one repository short.

The affected audience is the portfolio maintainer: repository administration remains individual-only and the declarative GitHub source of truth cannot yet prove complete team coverage.

Hypothesis and success signal

If the reviewed Admins team, maintainer membership, and one admin grant per active repository are activated declaratively, the next maintenance audit after Flux reconciliation should report zero active repositories without an admin team and zero without any team assignment.

Measurement window: the first scheduled maintenance audit after the released github-config artifact reconciles. Guardrails: do not grant the archived reusable-workflows repository, do not change the existing Maintainers permissions, do not claim Delete, and make no imperative GitHub-configuration writes.

Smallest useful change

• Add the kyverno-policies Admins grant, bringing the reviewed scope to 20 active repositories.
• List Team/admins, the explicit maintainer membership, and all 20 grants in the three production Kustomizations.
• Replace the short-lived default-off fixture with an activation regression that validates the production render directly.
• Update the policy comments, deployment documentation, and AGENTS.md to describe the active state.

Acceptance criteria

• The production render contains exactly one Admins team, one devantler maintainer membership, and 20 admin TeamRepository grants.
• kyverno-policies is included; archived reusable-workflows is excluded.
• Admins resources exclude Delete and external-name adoption; Maintainers grants remain unchanged at maintain.
• The obsolete default-off fixture is removed and the policy test validates the activated production render.
• kubectl kustomize deploy/, the policy test, ShellCheck, actionlint, and git diff --check pass.
• Parent Complete declarative team coverage (admin team + gap repos) #53 records the post-release Flux reconciliation and rerun outcome for maintenance chore(deps): update actions/checkout action to v4.3.1 - autoclosed #19/chore(deps): update actions/checkout action to v5 - autoclosed #20.

Rough size

S — declarative activation plus one new grant and regression/doc updates.

Part of #53.

[coderabbitai]

🔗 Related PRs

#67 - feat: require actions pinned to a full-length commit SHA on all repos but actions [merged]
#78 - feat(repositories): declare provider-upjet-unifi (net-new Library repo) [merged]
#82 - feat: declare the devantler-tech/aws config-tenant repo [merged]
#88 - feat: archived-repo pattern + reusable-workflows archival groundwork [merged]
#100 - docs(repositories): correct kyverno bootstrap contract [merged]

---

📝 Issue Planner

_{Check the box below or use the @coderabbitai plan command to generate an implementation plan and prompts that you can use with your favorite coding assistant.}

• Create Plan

---

🧪 Issue enrichment is currently in open beta.

You can configure auto-planning by selecting labels in the issue_enrichment configuration.

To disable automatic issue enrichment, add the following to your .coderabbit.yaml:

issue_enrichment:
  auto_enrich:
    enabled: false

💬 Have feedback or questions? Drop into our discord!