Feature/lab7

[wyroxx]

Goal

Complete Lab 7 container security work: Trivy image/K8s scanning, PSS restricted Kubernetes hardening, NetworkPolicy, and Conftest policy gate.

Changes

• Added hardened Juice Shop Kubernetes manifests under labs/lab7/k8s/
• Added PSS restricted namespace labels, dedicated ServiceAccount, securityContext, resource limits, digest-pinned image, and NetworkPolicy
• Added Conftest Rego policy at labs/lab7/policies/pod-hardening.rego
• Added Lab 7 submission report at submissions/lab7.md

Testing

• Trivy image scan completed for bkimminich/juice-shop:v20.0.0
• Juice Shop pod verified as 1/1 Running
• Trivy K8s scan completed for juice-shop namespace
• Conftest passed on hardened deployment
• Conftest failed correctly on intentionally bad deployment

Artifacts & Screenshots

• Submission: submissions/lab7.md
• Screenshots or links: N/A

Checklist

• Title is clear (feat(labN): <topic> style)
• No secrets/large temp files committed
• Submission file at submissions/lab7.md exists