This kustomization owns exactly the observability and observability-agent Namespace objects. Both opt into observability discovery through observability.hyeonworks.com/enabled: "true".

observability enforces, audits, and warns at restricted:latest. observability-agent enforces privileged:latest so the narrowly scoped agent workloads can use their approved read-only host mounts, while audit and warn remain restricted:latest.

discovery-namespaces.txt is an inventory for the later apply workflow. The five listed namespaces already exist and are deliberately not rendered here. That workflow may own only the observability.hyeonworks.com/enabled discovery label on those namespaces. It must preserve their existing Pod Security and purpose labels, and rollback must restore or remove only that exact discovery-label key.