Similar to the existing cred-freeze job, we could create a CI or nightly periodic that compares the frozen release's manifests with the candidate release's manifests, and complains to the patch manager for triage if capabilities are being added to an existing (kind, group, namespace, name) entry.  Because it seems like an easy thing to forget to do, and also not too hard to automate.  The difficulty, as with cred-freeze, will be messaging around failures to help patch managers figure out what happened and organize response.  The message should link OTA-1039 or its downstream implementation/enhancement as one possible mitigation for this sort of issue.

Definition of done, either:

• Land new CI jobs for main branch and released branches to find out if the manifests in the new release payload implicitly enables new capabilities
• The intent is to catch the detect this kind of capability-creep before it ships to customers.
• Talk to TRT team to see if they will accept this as a blocking job as regressions with this nature will be upgrade blockers.