[dan-petty]

fix(k8s): check example ConfigMap keys are settings

A new test walks the keys of the example ConfigMap and reports each key that no setting declares. Most models of Settings use extra=ignore, so such a key loaded with no error before. Two rules now say that a change which removes, renames or tightens a setting must say so in the proposal and the PR comment, and must load the example ConfigMap into Settings in a test. The live ConfigMap changes first. This follows the crash of the roadmap Service on 2026-11-07, when the live ConfigMap still held two removed ladder keys.

Closes #4093

Change: openspec/changes/archive/2026-11-08-4093-check-example-configmap-keys-are-settings/
Elapsed: 1.58s

[dan-petty]

Test record for #4093.

fail-to-pass (devops ci fail-to-pass --base origin/main, before the fix, on the test commit):

• tests/k8s/test_k8s_configmap_keys.py: errored on base (the module devops_cli.config.setting_keys does not exist).
• tests/invariants/test_configmap_rollout_rule.py: 2 cases failed on base (k8s/README.md, docs/ROADMAP_WORKFLOW.md hold no rule; assert 0 == 1).
• After the fix: 4 cases in the keys module and 2 invariant cases pass.
• Note: the ladder test shares the module import, so it errors on base too (the issue said it passes before).

Full devops ci on the final code: all 25 rows pass. The pytest row took 11m56s, over the 5 minute budget (known #3593). After the rebase onto cd2ebda, the two new test files and devops docs generate --check were run again and pass.

Rollout: this change removes, renames and tightens no setting, so the live ConfigMap needs no change. Nothing was applied to the cluster.