Kubescape posture scans fail since v4.0.16: the Sigstore trust-root fetch is blocked by egress #4966

🤖 Generated by the Agentic Engineer (interactive Claude Code session)

Expected Behavior

The daily in-cluster posture scan completes and writes fresh configuration-scan results.

Actual Behavior

Since the scanner moved to v4.0.16 (#4911, deployed 2026-10-15), every posture scan aborts before scanning anything. The new release verifies the checksums of the control and framework bundles it downloads, using Sigstore. To do that it first fetches Sigstore's trust root from Sigstore's TUF CDN, and the namespace's egress allow-list does not include that host. The fetch times out, the scan fails, and the posture results stay frozen at the last scan before the upgrade.

The scheduler Job still reports Completed, because it only fires the scan request, so nothing marks the failure. It is visible only in the scanner's log (failed to fetch Sigstore trusted root ... i/o timeout, first at the 16 October 09:12 UTC scan). It also blocks the post-deployment verification of #4523, which needs a fresh scan.

Steps to Replicate

1. Read the kubescape Deployment's log after a scheduled scan.
2. Observe scan failed with checksum verification failed: ... failed to fetch Sigstore trusted root.

Acceptance Criteria

• The scanner can reach Sigstore's TUF CDN on 443, added to the existing FQDN allow-list as that policy's own comment prescribes, and nothing broader.
• Checksum verification stays on; the fix does not disable or bypass it.
• After deployment, a scheduled or on-demand scan completes and writes fresh posture results. Read-only readback confirms it.