What

Add an annotation that shows what the label syncer would set.

Why

If a customer takes ownership of the audit and warn labels it is unclear what the label syncer would enforce, without evaluating all the SCCs of all users in the namespace.

This:

• creates a blindspot in CFE / cluster-debug-tools
• makes it hard to block upgrades confidently.

Notes

• Must be set, when label syncer would set the value.
• Can be set in all other cases (easier debugging on customer side).