Record IPMI isolation checks and enable verified resource pruning

apps/oldipmi/README.md

@@ -36,3 +36,27 @@ Verification: check Argo Synced/Healthy, non-root/zero-capability runtime,
 HTTP and WebSocket authentication redirects, admin policy/outpost membership,
 external connectivity and denied pod/node/Service/LoadBalancer destinations.
 Actual hardware KVM verification requires identifying the BMC and logging in.
+
+## Verified deployment
+
+On 2026-10-31, CI passed the rendered security checks and the Podman
+HTTP/WebSocket/RFB runtime test, published the chart anonymously, and promoted
+its version through GitOps. Argo reached Synced/Healthy with zero pod restarts.
+The browser ran as UID 1000 with CapEff=0, NoNewPrivs=1 and seccomp mode 2;
+no service-account token or persistent volume was present.
+
+Unauthenticated page, asset and WebSocket requests redirected to Authentik,
+including a request with forged Authentik identity headers. The provider's only
+group binding was `authentik Admins`. Traefik could fetch the backend; an
+unrelated Authentik pod could not connect directly to its web port.
+
+The browser reached public DNS, Internet HTTPS, LAN Victron (192.168.0.169)
+and Funkfeuer (10.12.4.172 HTTP/SSH). Connections to the Kubernetes API Service,
+API node, its own node SSH, an Authentik pod, the Traefik MetalLB address, and
+the cluster's Funkfeuer service address timed out. Kubernetes local names did
+not resolve. A real WebSocket upgrade returned the VNC RFB protocol handshake.
+No BMC login or physical server KVM session was tested: its address is unknown.
+
+Archival: NOT APPLICABLE. The source was a standalone local Podman command,
+with no legacy deployment repository. The new chart repository is retained
+because it owns the deployment contract and publication pipeline.

bootstrap/oldipmi.yaml

@@ -25,7 +25,7 @@ spec:
   syncPolicy:
     automated:
       enabled: true
-      prune: false
+      prune: true
       selfHeal: true
     managedNamespaceMetadata:
       labels: