EPMDEDP-17405: docs: Document read-only Tekton definitions for developers in 3.16

[SergK]

Summary

Jira: EPMDEDP-17405. Documents edp-install #590 (merged): in the platform namespace, developers can no longer modify Pipelines, Tasks, Triggers, TriggerBindings or TaskRuns. Pipeline definitions come from one auditable source of truth, a reviewed Git repository applied through GitOps, instead of hand-applied resources that drift from Git.

 docs/operator-guide/upgrade/
+└── upgrade-krci-3.16.md          # new: v3.15 to 3.16 guide, seeded for the 3.16 release
 docs/operator-guide/auth/
 └── platform-auth-model.md        # + Tekton Pipeline Permissions table, + Sensitive Capabilities row
 docs/user-guide/
 ├── pipelines.md                  # edit and delete need admin rights; 3.16 note in Edit Pipelines/Tasks
 ├── tekton-pipelines.md           # applying to the platform namespace needs admin rights
 ├── customize-ci-triggers.md      # page-level note: admin rights or GitOps
 ├── manual-approval.md            # same note
 └── add-quality-gate.md           # same, in step 4
 docs/use-cases/
 └── cd-autotests-run-with-env-variables.md   # admin-rights precondition
 faq/how-to/developer/
 └── create-pipeline-task-trigger-template.md # Git, review, Argo CD sync first; reads correctly for 3.15 and 3.16
 sidebars.ts                       # 3.16 guide above 3.15

Upgrade guide structure, following the 3.13–3.15 guides:

Step 1. (Required) Verify Prerequisites
Step 2. (Required) Review Developer Permissions for Tekton Resources (edp-install)
          3.15 vs 3.16 table · what keeps working · who must act
          GitOps delivery (recommended) · optional extraObjects Role for Pipelines/Tasks · kubectl auth can-i check
Step 3. (Informational) Breaking Changes and Deprecations
Step 4. Upgrade
Step 5. Post-Upgrade Verification

A maintainer comment at the top of the guide (stripped from the build) lists how to add further 3.16 changes: insert by urgency, renumber, update step anchors, add Breaking Changes and verification entries.

Release-time placeholders, marked with HTML comments in the guide:

• 3.16.0 chart version in Step 4.
• Dependency versions in Step 1 and the dependency note in the introduction.

Also corrects a pre-existing statement: deleting PipelineRuns has required administrator rights since 3.14 (EPMDEDP-16728).

Evidence

• Before: user-guide/pipelines.md described viewing and editing Pipelines and Tasks for all users; the developer FAQ told developers to create resources directly in the cluster.
  After: pages state the 3.16 permissions; the 3.16 upgrade guide documents the change and the migration path.
• Permission tables match the merged Role (edp-install 4be621055) and were checked on a kind cluster with kubectl auth can-i, impersonating the developer group: PipelineRuns get list watch create patch; TaskRuns, Pipelines, Tasks, Triggers, TriggerBindings get list watch; PipelineRun delete denied.
• The extraObjects example renders with helm template against edp-install 4be621055 into a Role and a RoleBinding for <namespace>-oidc-developers.
• npm run build: passes, no broken-anchor warnings. npm run spell-check: 0 issues. npm run typecheck: passes.
• Not verified in a browser: the portal Edit action being unavailable to developers. It is based on the portal permission check (SelfSubjectAccessReview on update) and on can-i results with a developer ServiceAccount token.

Merge Danger

Door: two-way

Documentation only; a revert restores the previous pages.

Blast Radius: docs

docs/ changes publish under /docs/next (3.16-dev) only. The FAQ page is not versioned and goes live on merge; its wording holds for both 3.15 and 3.16. Merge after edp-install #590 (already merged).

[github-actions]

Azure Static Web Apps: Your stage site is ready! Visit it here: https://gentle-pebble-0839af61e-435.westus2.4.azurestaticapps.net