fix: suppress CKV_K8S_21 false positive on knowledge-explorer Helm chart

Checkov's helm framework renders the chart without a namespace override,
so metadata.namespace (set to .Release.Namespace, bound only at install
time) always resolves to "default" and trips CKV_K8S_21 on service.yaml,
deployment.yaml, and configmap.yaml even though the chart is
namespace-agnostic by design.

Suppressed via per-file checkov:skip comments, following the same
convention already used for the Cloud Run false positives in
deploy/gcp/cloudrun-service.yaml.

.checkov.yaml

@@ -2,4 +2,11 @@
 # Cloud Run false-positives (CKV_K8S_21/28/30) are suppressed via per-file
 # inline checkov:skip comments in deploy/gcp/cloudrun-service.yaml rather than
 # globally here, so future real Kubernetes manifests are not silently exempted.
+#
+# The knowledge-explorer Helm chart's unconditional templates (service.yaml,
+# deployment.yaml, configmap.yaml) set metadata.namespace to .Release.Namespace,
+# which is only bound at `helm install`/`helm template` time. Checkov's helm
+# framework renders the chart without a namespace override, so it always
+# resolves to "default" and trips CKV_K8S_21 even though the chart is
+# namespace-agnostic by design. Suppressed the same way, per-file.
 skip-check: []

CHANGELOG.md

@@ -11,6 +11,10 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Fixed
 
+- **Checkov flagged the knowledge-explorer Helm chart for using the default Kubernetes namespace** ([code scanning alert #779](https://github.com/semantica-agi/semantica/security/code-scanning/779), [#778](https://github.com/semantica-agi/semantica/security/code-scanning/778), [#777](https://github.com/semantica-agi/semantica/security/code-scanning/777), `CKV_K8S_21`) by @KaifAhmad1
+  - `templates/service.yaml`, `templates/deployment.yaml`, and `templates/configmap.yaml` all already set `metadata.namespace` to `{{ .Release.Namespace }}`, which is only bound at `helm install`/`helm template` time; Checkov's helm framework renders the chart without a namespace override, so it always resolves to `default` and trips `CKV_K8S_21` even though the chart is namespace-agnostic by design
+  - Added a `# checkov:skip=CKV_K8S_21` comment to each of the three files, following the same per-file suppression convention already used for the Cloud Run false positives in `deploy/gcp/cloudrun-service.yaml`, and documented the reasoning in `.checkov.yaml`
+
 - **No React error boundaries around lazy-loaded Explorer workspaces — a single render error crashed the whole app** (#768, #794) by @Sameer6305
   - Added an `ErrorBoundary` class component (`explorer/src/ErrorBoundary.tsx`) and wrapped each lazy-loaded workspace's `<Suspense>` block in `App.tsx` with it, keyed on the active sub-view so navigating away from and back to a crashed tab remounts it cleanly
   - Failed retries are capped at 3 before the fallback UI switches from "Try Again" to a "Reload Application" dead-end, preventing infinite retry loops on deterministic crashes; raw error/stack details are logged via `console.error` only and never rendered into the fallback UI

deploy/helm/knowledge-explorer/templates/configmap.yaml

@@ -1,3 +1,4 @@
+# checkov:skip=CKV_K8S_21:namespace is set to .Release.Namespace below, supplied at install time via `helm install -n <namespace>`; Checkov's helm-chart renderer runs without a namespace override and always resolves this to "default", which is a scanner artifact, not the deployed value
 apiVersion: v1
 kind: ConfigMap
 metadata:

deploy/helm/knowledge-explorer/templates/deployment.yaml

@@ -1,3 +1,4 @@
+# checkov:skip=CKV_K8S_21:namespace is set to .Release.Namespace below, supplied at install time via `helm install -n <namespace>`; Checkov's helm-chart renderer runs without a namespace override and always resolves this to "default", which is a scanner artifact, not the deployed value
 apiVersion: apps/v1
 kind: Deployment
 metadata:

deploy/helm/knowledge-explorer/templates/service.yaml

@@ -1,3 +1,4 @@
+# checkov:skip=CKV_K8S_21:namespace is set to .Release.Namespace below, supplied at install time via `helm install -n <namespace>`; Checkov's helm-chart renderer runs without a namespace override and always resolves this to "default", which is a scanner artifact, not the deployed value
 apiVersion: v1
 kind: Service
 metadata: