[Umbrella] Action items from CNCF TOC due diligence review

[RainbowMango]

Background

The CNCF TOC is reviewing Karmada's graduation due diligence (cncf/toc#2278, application: cncf/toc#1572).
This issue tracks the findings and recommendations.

🔴 Blocking: sync OWNERS files with MAINTAINERS.md

• Remove emeritus maintainers from OWNERS files (they still hold approval rights enforced by Prow): (@zhzhuang-zju, sync OWNERS files with MAINTAINERS.md karmada#7842)
  • @mrlihanbo (4 files), @lfbear (2 files), @carmark (1 file), @zoroyouxi (1 file)
• Add active maintainers missing from the main repo's OWNERS approvers: (@zhzhuang-zju, sync OWNERS files with MAINTAINERS.md karmada#7842)
  • @warjiang, @CharlesQQ, @GitHubxsy, @wawa0210

🟡 Non-blocking recommendations

• Automated certificate rotation to reduce operational burden at scale (Support automatic cert rotation & fix a few bugs karmada#5037, helm: support rotating cert when helm upgrade karmada#6553)
  • tracking issue:
    • Publish Certificate Rotation Guide website#1014
  • related issue/PR:
    • Support automatic cert rotation & fix a few bugs karmada#5037
    • helm: support rotating cert when helm upgrade karmada#6553
• Security audit follow-ups: track LuaVM DoS (blocked on upstream gopher-lua); harden pod security contexts (drop unnecessary privileges)
• Work toward OpenSSF Best Practices silver badge (currently passing)

📋 Adopter feedback (roadmap candidates, from TOC adopter interviews)

• Performance at scale (e.g. Work object overhead reported by large-scale adopters)
• Conformance test suite for platform teams to validate new versions
• Improve review speed for large community contributions; grow North America presence
• Cost-aware / region-aware workload placement for AI workloads
• Documentation for industry-specific policies (e.g. financial sector)