When a hardening rollout breaks 8 layers and your own reconciler fights you

The first thing the on-call team tried was patching the status ConfigMap. Five apps showed Progressing in the platform's bleater-status object, the dashboard had been red for four hours, and somebody