Kyverno PolicyReport observability (Prometheus/Grafana + policy-reporter)

[gangster]

Deferred from Kyverno Phase 5 (#76, ADR-014). The reporting piece — surfacing Kyverno PolicyReports as metrics/dashboards — needs an observability stack that doesn't exist yet.

When

Land this alongside the roadmap monitoring stack (Prometheus + Grafana), expected soon.

Scope

• Deploy policy-reporter (Kyverno's PolicyReport UI + Prometheus metrics exporter).
• Grafana dashboards: policy violations by tenant/policy/severity over time; Enforce vs Audit; verifyImages failures.
• Alerting on spikes / new violations (compliance evidence — ADR-013/037).

Meanwhile

PolicyReports are already queryable: kubectl get policyreport -A / kubectl get clusterpolicyreport.

Refs: #76, ADR-014, ADR-013, ADR-037.