feat(kilobase): add backup watchdog CronJob

[h0lybyte]

Summary

• Adds a daily backup watchdog CronJob that monitors CNPG backup health and cleans up stale metadata
• Health check: Verifies a backup succeeded in the last 48 hours. Exits non-zero if not (visible as failed Job in ArgoCD/monitoring). Catches silent failure streaks like the cert expiry incident.
• Metadata cleanup: Deletes failed Backup CRDs older than 7 days and completed ones older than 60 days
• Status report: Logs summary of backup counts and ScheduledBackup status

Details

• Runs daily at 3:30 AM UTC (between 2 AM backup and 4 AM Sunday fire drill)
• Full security hardening: pinned bitnami/kubectl:1.31.5, runAsNonRoot, readOnlyRootFilesystem, drop ALL caps, seccomp RuntimeDefault
• Minimal RBAC: only get/list/delete on backups, get/list on scheduledbackups
• Single file with SA + Role + RoleBinding + CronJob (follows existing patterns)

Test plan

• Verify ArgoCD syncs the CronJob, SA, Role, and RoleBinding
• Trigger manual run: kubectl create job --from=cronjob/backup-watchdog backup-watchdog-test -n kilobase
• Confirm health check passes (recent backups are succeeding)
• Confirm old failed Backup CRDs (>7d) are deleted
• Confirm completed Backup CRDs >60d are deleted
• Verify status report in logs

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Scanned Files

None