Your Kyverno CI Is Lying to You: Why kyverno-cli Exits 0 on Policy Violations

How a two-week CI false-green exposed a critical kyverno-cli behavior — and the exact bash fix using $PIPESTATUS[0] that makes policy enforcement actually enforce.