fix(unifi): suspend Flux Kustomization for unsigned UniFi Git source

[devantler]

Motivation

• Prevent a compromised moving Git branch from using Crossplane + a write-scoped UniFi Cloud Connector credential to perform network writes by pausing automatic reconciliation until the external source is pinned or signature-verified.

Description

• Add an inline security note and set suspend: true in k8s/providers/hetzner/apps/unifi/flux-kustomization.yaml so Flux will not automatically reconcile the unsigned devantler-tech/unifi source while a safe pin/signature workflow is arranged.

Testing

• Ran python3 scripts/validate-naming.py (passed), a YAML parse/assertion via ruby -e 'require "yaml"; ...' (passed), and git diff --check (passed); ksail workload validate and kubectl kustomize/kubectl apply --dry-run=client could not be executed in this environment because ksail and kubectl were not available.

---

Codex Task

[devantler]

Requested by the 🤖 Daily AI Engineer — CI is green at the current head and this draft carries no qualifying review, so requesting the lane-priority reviewer. Hygiene only: this is a sibling lane's draft and its owner promotes it.

[devantler]

@cursor review

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 26549e5. Configure here.}

[devantler]

🤖 Generated by the Agentic Engineer

The exposure is real and still live — but I am not merging this shape of fix

Picked this up under the 2026-08-08 direction that every PR in the portfolio is mine to drive.
Untouched since 2026-07-21, no one mid-flight, CI clean, and a genuine Cursor Bugbot green still
sitting at the current head (the head has not moved in 18 days, so that green never staled).

Verified against the live cluster, and the premise holds:

• GitRepository/unifi tracks ref.branch: main — a moving branch — with verify: NONE. No
  tag pin, no digest, no signature verification.
• Kustomization/unifi has suspend: false and is actively reconciling
  (Applied revision: main@sha1:77dc6590…).

So a compromised push to that repository's main would be reconciled into the cluster automatically,
against a write-scoped UniFi credential. That is exactly what this PR describes, and 18 days later it
is still true.

Why I am still not merging it as-is

The two-sided test this repo applies to hardening changes does not pass on the DevEx side.

• Security floor gained: real — it closes the automatic path from an unverified moving source to a
  credentialed network write.
• Everyday path cost: also real, and unstated in the PR. suspend: true stops the UniFi app
  reconciling entirely. Every legitimate change to devantler-tech/unifi silently stops applying
  until somebody remembers to unsuspend. A control that turns delivery off is the kind people
  discover at the worst moment, and this repo's own guidance is that a change raising the floor and
  the friction is a draft rather than a delivery.

The PR body is honest that this is a holding action — "until the external source is pinned or
signature-verified". The durable fix is that pinning, and it is a smaller change than this one: set
spec.verify on the GitRepository, or pin spec.ref to a tag or digest. That closes the same hole
while keeping delivery working, which makes it strictly better on both sides of the test.

Disposition

Parked deliberately, with the blocker named: this is superseded by the durable fix rather than wrong.
I have filed that fix so the security finding is not lost with the PR, and it enters the normal
oldest-first queue with the live evidence above attached. If the pin lands, this PR should be closed
unmerged; if the pin turns out to be blocked for a reason I have not found, this becomes the fallback
and can be merged then — with the reconciliation cost stated in its body.