Strip remaining webhook-only scaffold and network-policy manifests

Follows the approved lean-down plan
(docs/plans/2026-08-08-1335-lean-scaffold-cleanup.md). Removes from the
application's deployed footprint:

- config/network-policy/ and its commented enable line -- the user does
  not need network policies at the moment.
- The webhook-only halves of config/default/kustomization.yaml: the
  commented ../webhook and ../certmanager resource lines, the
  manager_webhook_patch.yaml reference, the serving-cert ->
  Validating/Mutating WebhookConfiguration cainjection replacement
  blocks, and the crdkustomizecainjection* scaffold markers -- anchors
  only for `kubebuilder create webhook`, which is a permanent non-goal.
- The two commented [WEBHOOK] blocks in config/crd/kustomization.yaml
  plus the now-empty patches: key; kept the one-line
  crdkustomizeresource marker since `kubebuilder create api` could
  legitimately run again.
- config/crd/kustomizeconfig.yaml, whose only consumer was the removed
  configurations: block.

Explicitly kept per user direction: all of config/prometheus/, the
paired metrics-TLS-via-cert-manager plumbing (cert_metrics_manager_patch
+ the metrics-certs/ServiceMonitor replacement halves), all RBAC
manifests including the admin/editor/viewer helper roles, and all
developer tooling.

Also records in the execution log why the webhook machinery existed at
all: kubebuilder init emits it unconditionally, verified against the
v4.15.0 binary that no init flag can suppress it -- scaffold-then-prune
is the only supported path, and the pruning pass should have happened
at Step 0.

Verified: kustomize build clean on config/default and config/crd,
go build/vet clean with and without -tags=e2e, make test green with
coverage identical to pre-cleanup.

Co-Authored-By: Claude <noreply@anthropic.com>

docs/plans-executions/2026-08-07-1747-proxy-operator.md

@@ -477,3 +477,86 @@ go build -tags=e2e ./... && go vet -tags=e2e ./...
 
 Both clean. `make test` green across the whole repo, unchanged from before
 the cleanup.
+
+## Cleanup — lean-down audit of Steps 0–3
+
+Planned and approved separately in
+[docs/plans/2026-08-08-1335-lean-scaffold-cleanup.md](../plans/2026-08-08-1335-lean-scaffold-cleanup.md).
+Prompted by the user asking (a) why webhook machinery existed at all when the
+spec's §12 says "do NOT build: admission webhooks, cert-manager wiring", and
+(b) for a full audit of completed work so the project starts as lean as
+possible.
+
+**Why the webhook machinery existed — for the record.** `kubebuilder init`
+emits it unconditionally: the active webhook-server wiring in `cmd/main.go`,
+cert-manager install in the e2e utils, and commented kustomize anchor blocks
+all arrive with `init`, not with `create webhook` (never run here). At Step 0
+the scaffold was deliberately committed untouched as a reviewable baseline
+(only `.github/` stripped), and spec §3's "config/ (scaffold-generated, kept
+working)" was read as license to keep the rest. The process gap: §12's
+non-goals deserved a pruning pass immediately *after* the baseline commit,
+especially for the parts that actually did something. The user caught it, not
+the build process.
+
+**Could `init` have skipped it?** No — verified against the v4.15.0 binary,
+not from memory:
+
+```bash
+kubebuilder init --help
+# flags: --domain --repo --owner --license(-file) --multigroup --namespaced
+#        --fetch-deps --skip-go-version-check --project-version --plugins
+# nothing subtracts features; optional plugins (helm, grafana, deploy-image,
+# autoupdate) are all additive — there is no "minimal" plugin
+```
+
+Scaffold-then-prune is the only supported path to a lean baseline. Worth
+knowing at the *next* project bootstrap: plan the pruning pass as part of
+scaffolding, not as a later discovery. (`--namespaced` was the one
+arguably-applicable flag, but it conflicts with the kubernetes-pod provider's
+cluster-wide `ListByTag` for orphan GC — cluster-scoped was correct.)
+
+**Audit result for the Go code: clean.** Nothing beyond spec that isn't a
+justified, already-logged deviation (`Instance.UID`/`CreatedAt`,
+`MaxLeases *int32`, `HealthCheck default={}`, registry-as-parameter,
+kubernetes provider per user decision). Trivial extras (`shortName=px`,
+`MaxProperties=32`) stay.
+
+**Scope lines drawn by the user during plan review** — recorded because they
+shape what "lean" means for this repo going forward:
+
+- Developer tooling is exempt: `.golangci.yml`, `.custom-gcl.yml`,
+  `.devcontainer/`, `AGENTS.md`, Makefile `lint`/`docker-buildx`/
+  `build-installer` targets all stay ("tooling around the project is cool, i
+  just want the application code produced to start as lean as possible").
+- Monitoring manifests stay: all of `config/prometheus/`, plus the paired
+  metrics-TLS-via-cert-manager plumbing
+  (`config/default/cert_metrics_manager_patch.yaml` and the metrics-certs/
+  ServiceMonitor halves of the commented replacements block) — removing half
+  of a pair would leave dangling comment references.
+- All RBAC manifests stay, including the `proxy_admin/editor/viewer` helper
+  ClusterRoles whose own headers say "not used by the project itself".
+- Network policies go: "we do not need any network policies at the moment".
+
+**Removed:**
+
+- `config/network-policy/` (kustomization.yaml, allow-metrics-traffic.yaml)
+  plus its commented `#- ../network-policy` line in the default kustomization.
+- Webhook-only remnants in `config/default/kustomization.yaml`: the commented
+  `#- ../webhook` / `#- ../certmanager` resource lines, the
+  `manager_webhook_patch.yaml` patch reference, and the webhook halves of the
+  replacements block (serving-cert → Validating/Mutating WebhookConfiguration
+  cainjection, conversion webhook, and the
+  `+kubebuilder:scaffold:crdkustomizecainjection*` markers — anchors only for
+  `kubebuilder create webhook`, permanently a non-goal).
+- The two commented `[WEBHOOK]` blocks in `config/crd/kustomization.yaml`
+  (conversion patches + the `configurations:` reference), along with the empty
+  `patches:` key they lived under and the `crdkustomizewebhookpatch` marker.
+  Kept the one-line `crdkustomizeresource` marker — `kubebuilder create api`
+  could legitimately run again.
+- `config/crd/kustomizeconfig.yaml` — only consumer was the removed
+  `configurations:` block.
+
+Verified: `bin/kustomize build config/default` and `... config/crd` both
+render cleanly (no dangling references), `go build`/`go vet` clean with and
+without `-tags=e2e`, `make test` green with coverage numbers identical to
+pre-cleanup.