Kyverno allowLatestTag Pitfalls: How Policy Can Stop Pods From Restarting

A disallow-latest-tag policy only blocks new admissions. That gap turns a routine pod eviction into a permanent outage. Here's the failure mode and the fix.