🤖 Generated by the Daily AI Assistant

What

The ksail limitations this repo's CI was working around are now resolved upstream. This adopts the fixes and refreshes the now-stale references.

• Lift the 7.65.0 validate/scan determinism pin. The non-deterministic in-process Helm render (ksail#5371) is closed COMPLETED, so the Setup-KSail step rejoins Renovate management (grouped ksail with the deploy-prod / dr-rebuild pins) at the latest release (7.77.0). A tripwire comment says to re-pin + reopen #5371 if validate/scan ever swing run-to-run again.
• Refresh the Kubescape scan comment. Native scan exceptions (ksail#5369) have shipped; wiring the platform's ClusterSecurityException CRs in to ratchet --compliance-threshold toward 100 is tracked in ci: ratchet the Kubescape scan threshold toward 100 via ksail workload scan --exceptions (#5369 shipped) #2264. The threshold stays 85 here.
• Reconcile the AGENTS.md Validation bullets, which cited the now-closed issues as open blockers and contradicted themselves on the threshold (one bullet said 85, another said 94; CI uses 85). Now two consistent bullets matching the ## Two non-obvious limits intro.

Why this is a draft — promotion gate

The pin lift can only be proven by CI: the platform documents that the Kubescape compliance score is environment-dependent and not reproducible offline, and determinism is a run-to-run property. Promote once CI is green and validate/scan is confirmed deterministic across a few runs — and the scan score on 7.77.0 clears the 85 floor (a ksail bump can shift the score; the comment now flags re-baselining). If it flakes or drops below 85, re-pin per the tripwire instead of promoting.

Out of scope (deliberately)

• ksail.prod.yaml is a protected file, so its inline comments that still reference resolved items (#5015 user_data limit, #5017→#5021 maxNodesTotal, #5277 capacityBuffers, the expander-list note — all merged/shipped) are left untouched. Flagging here so a maintainer can refresh them directly if wanted.
• The --exceptions wiring + threshold ratchet → tracked in ci: ratchet the Kubescape scan threshold toward 100 via ksail workload scan --exceptions (#5369 shipped) #2264 (needs the released flag's input format + CI to establish the new stable floor).

Validation

actionlint .github/workflows/ci.yaml passes. No manifest changes (k8s/** untouched), so no ksail workload validate is required — this is CI config + docs only.

Filed from a holistic platform↔ksail review (the same review that fed ksail#5441 / #5442 / #5443 and evidence onto the open epic ksail#5344 upstream).