ROX-37315: Keep deploy checks with image exclusions (release-4.11) - #23214

Description

Jira: ROX-37315

Backport PR #23107 to release-4.11. Image-only exclusions currently cause Build and Deploy policies to skip all deployment checks. The fix keeps deploy-time detection and entity policy lists active while image exclusions continue to apply at Build.

• Guard deployment and audit-event exclusion matching against image-only exclusions.
• Carry the regression tests and add the behavior notice to the next-release changelog.

Deployment exclusions remain the way to exempt deployments. Applying image exclusions at Deploy would change their documented Build-only behavior.

Release timing: Please have the 4.11 release engineer approve the patch cycle before merging this draft. Target 4.11.6 after the 4.11.5 candidate process.

User-facing documentation

• CHANGELOG.md is updated OR update is not needed
• documentation PR is created and is linked above OR is not needed

Testing and quality

• the change is production ready: the change is GA, or otherwise the functionality is gated by a feature flag
• CI results are inspected

Automated testing

• added unit tests
• added e2e tests
• added regression tests
• added compatibility tests
• modified existing tests

How I validated my change

• Passed go test ./central/policy/matcher ./pkg/detection ./pkg/detection/deploytime on release-4.11.
• No UI code changed. The matcher test covers policy visibility for deployments, namespaces, and clusters.