Where do Assessment Results persist in-cluster, with what retention?

[backend-bunny]

Question

OSCAL Assessment Results are the artifact of record, but there is nowhere obvious to put them: no egress, no external object store assumed, single cluster.

• CRD status, a dedicated result CR per run, a PVC, or an in-cluster object store? Each AR document may be large and they accrue continuously.
• etcd is the wrong home for an append-only evidence log. If results become CRs, what bounds the object count and size?
• What is the unit of persistence — one AR per assessment run, or one rolling document per control? (Depends on the AR granularity finding.)
• Retention: how long is evidence kept, what prunes it, and who decides? Under a cATO posture, deleting evidence has consequences that a default maxHistory: 10 does not appreciate.
• How does a consumer retrieve results, given the consumer is in-cluster and there is no export path in v1?
• What survives an operator restart, an upgrade, or a cluster rebuild?

Resolution: the persistence mechanism, the retention policy and who controls it, and the retrieval path.