[willgriffin]

Migration qualification needs to keep credential-free public static routes online while independently proving that application writers are fenced. Add an optional strict static-workload observer and a fresh native writer-fence lease guard; preserve existing policy behavior when these optional policies are absent.

Bind static workloads to exact native Deployment/ReplicaSet/Pod ancestry, immutable public configuration, image identity and no-egress policy. Authenticate the lease producer controller/program and complete current workload UID map on every safety callback. At first startup, wait at most 30 seconds for authenticated initial enrollment before any database-related import or factory; malformed, stale and foreign leases fail closed. Safely retained terminal migration history remains supported, while active read-only Pods must exactly match the current map.

Preserve dormant native ReplicaSet history that predates instance labels only when the label is absent, every replica count is zero, and the exact native owner identifies one current enrolled Deployment. Explicit foreign labels, active or deleting history, forged ownership and unexplained Pods remain rejected. Historical objects do not become approved nonwriters or UID-map entries.

Validation: all six repository gates passed on exact head dcb4ef3d63146417a297293c255bf6d255137180: format-check, lint, check, test, build and strict knowledge freshness. All 296 targeted observer tests passed, including two new history regressions that fail on the prior head. Two independent advanced reviewers cleared the complete current diff; no accepted blocker remains.

This PR prepares the application side. Candidate images and actual Kubernetes/Flux admission, CNI, credential rotation, provider/OCR and full adoption/recovery qualification remain required before live rollout. It does not select production adoption.

Refs #236; the umbrella remains open until full qualification and rollout are verified.

[willgriffin]

Native target inventory exposed a further qualification blocker: retained, fully drained legacy ReplicaSets keep their original labels after Helm adopts the parent Deployment. The current observer would reject that history. A narrow ancestry-and-zero-count correction is committed locally and is undergoing full validation and independent review; please hold merge until this PR is updated to the qualified revision. Live adoption remains held.

[willgriffin]

The historical ReplicaSet correction is now published at dcb4ef3d63146417a297293c255bf6d255137180. All six local repository gates and 296 targeted tests passed; two independent advanced reviewers returned CLEAN on the complete current diff. The earlier hold for updating the PR head is resolved. Exact-head GitHub checks must pass before any authorized merge. Candidate publication and actual platform/adoption qualification remain required; no live rollout go-ahead has been issued.