TL;DR. On top of part 2's offline render tests I added two Kyverno Chainsaw layers. One applies every composition to a throwaway kind cluster with no cloud credentials on every pull request, so nothing real gets created. The other applies the same use cases with real credentials to a prod-like environment, which mirrors production but can run a branch, and waits for Ready and verified cloud state. A third job upgrades existing composite resources (XRs) to the PR's compositions. I chose Ch...