Warning: This build has drifted.
The coverage report for this pull request build may be inaccurate because its base commit is no longer the HEAD of its target branch.
This means it includes changes from outside the original pull request, including, potentially, unrelated coverage changes.

    • Learn more: For more information on this, see Tracking coverage changes for pull request builds.
    • Fix now: For a quick fix, rebase this PR at GitHub. Your next report should be accurate.
    • Prevent going forward: To avoid this issue with future PRs, see these Recommended CI Configurations.

fix(resource): look up a resource's policies by its stored namespace

deletePolicies takes the loaded resource, so a wrong namespace from a
caller cannot leave policies behind. Tests cover a failed policy list,
the stop at the first failed policy delete, and the stored namespace;
the e2e case also checks the user's permission and the policy's role
binding rows in relations.