[chrischeng-c4]

Closes #14

Summary

• CRD drift gate added: Added committed_crd_matches_generator test in crates/keep/tests/operator.rs asserting byte-equality between committed k8s/operator/crd.yaml and the generator output keep::operator::crd_yaml(), using cli_std::artifact::ensure_trailing_newline.
• Regeneration failure diagnostic: The test failure panic message explicitly directs the developer to run: cargo run -p keep --features operator -- k8s crd render --out k8s/operator/crd.yaml.
• CRD regenerated for measured drift: Regenerated k8s/operator/crd.yaml using the exact command above. The newly added fields from KeepSpec are:
  • evictionPolicy: Memory eviction policy (KEEP_EVICTION_POLICY, default allkeys-lru)
  • maxDiskBytes: Optional maximum disk quota for /data/blobs/ (KEEP_MAX_DISK_BYTES)
  • maxmemory: Optional explicit memory cap (KEEP_MAXMEMORY)
  • spillThresholdBytes: Byte size threshold above which Bytes payloads spill to /data/blobs/ (KEEP_SPILL_THRESHOLD_BYTES)
• CI updated: Added cargo test --locked -p keep --features operator --test operator to .github/workflows/keep-ci.yml under "Run Keep gates".
• Negative control verified: Temporarily changed k8s/operator/crd.yaml line (name: keeps.keep.dev -> name: keeps-negative-control.keep.dev), verified cargo test --locked -p keep --features operator --test operator failed with the exact regeneration command in the failure output, and reverted before committing.

Test Verification

• Local unit tests passed:
  • cargo test --locked -p keep --features operator --test operator (6 tests passed, including committed_crd_matches_generator, rustls_provider_install_is_idempotent, crd_is_openapi_compatible, crd_flattens_cluster_spec, render_emits_downward_api_statefulset, render_emits_backup_cronjob_when_configured)
  • cargo fmt --all -- --check
• Negative control: verified locally that modifying k8s/operator/crd.yaml causes committed_crd_matches_generator to fail with the exact regeneration command.
• Local tests not run:
  • Full workspace suite, e2e, integration, and performance benchmarks were NOT run locally per confirmed user test policy.
• Cloud MR verification needed:
  • Required cloud CI checks for PR/MR on GitHub Actions (keep-ci.yml gates: fmt, clippy, tests, release contract).