fix: unblock v02 gitops ts reconciler

scripts/g14-gitops-render.mjs

@@ -1320,6 +1320,15 @@ function apiPath(item) {
   return "/apis/" + encode(parts[0]) + "/" + encode(parts[1]) + "/namespaces/" + encode(ns) + "/" + plural + "/" + encode(name);
 }
 
+function reconcilePolicy(item) {
+  const ns = item.metadata?.namespace || namespace;
+  const crossNamespaceRbac = (item.kind === "Role" || item.kind === "RoleBinding") && ns !== namespace;
+  if (crossNamespaceRbac && process.env.HWLAB_RECONCILE_CROSS_NAMESPACE_RBAC !== "1") {
+    return { action: "skip", reason: "cross-namespace-rbac-bootstrap-managed", namespace: ns };
+  }
+  return { action: "apply", namespace: ns };
+}
+
 function request(method, path, body) {
   const payload = body ? JSON.stringify(body) : "";
   const headers = { Authorization: "Bearer " + token };
@@ -1344,6 +1353,11 @@ function request(method, path, body) {
   const results = [];
   for (const file of manifestFiles) {
     for (const item of itemsFrom(file)) {
+      const policy = reconcilePolicy(item);
+      if (policy.action === "skip") {
+        results.push({ file, kind: item.kind, name: item.metadata?.name || null, namespace: policy.namespace, status: "skipped", reason: policy.reason });
+        continue;
+      }
       const path = apiPath(item);
       if (!path) {
         results.push({ file, kind: item.kind, name: item.metadata?.name || null, status: "skipped-cluster-scoped" });