[realshuting]

Related issue

kyverno/kyverno#16612

Documents the MutatingPolicy features implemented in kyverno/kyverno#16614 with the API fields from kyverno/api#112.

Proposed Changes

Extends the MutatingPolicy page's "Mutating Existing Resources" section:

• Evaluation Order: documents the two-phase flow — trigger (matchConstraints → matchConditions → variables → targetMatchConstraints resolution) and target (target rule matching → targetMatchConditions → mutations → persistence through the declared route). Notes that variables are lazily available in trigger matchConditions (at most once, on first reference) and the native MutatingAdmissionPolicy autogen caveat, matching docs: align match condition variable semantics with implementation api#113.
• Filtering Targets with targetMatchConditions: documents the new field with an example filtering targets by combining target state (object) with trigger data (variables).
• Mutating Subresources: documents subresource routing for target resource rules, with an in-place Pod vertical scaling example through pods/resize (Kubernetes 1.33+) and the RBAC note for the background controller.
• Notes that targetMatchConstraints.expression may reference trigger-derived variables.

Examples mirror the conformance-tested policies from kyverno/kyverno#16614.

Checklist

• I have read the contributing guidelines.
• I have inspected the website preview for accuracy.
• I have signed off my issue.