Please address the comments from this code review:

## Overall Comments
- In `sensor/admission-control/main.go`, `metrics.NewServer(...).RunForever()` is called before `settingswatch.WatchK8sForSettingsUpdatesAsync`, and if `RunForever()` blocks (as its name suggests) the settings watcher is never started; consider running the metrics server in a separate goroutine or moving the call so it doesn't prevent later initialization.
- For the new admission-control metrics in `manager/metrics.go`, consider introducing typed constants or enums for label values like `result` and `source` (e.g., `hit/miss/expired`, `sensor/central`, `allowed/denied/...`) to ensure producers use consistent values and avoid accidental cardinality explosions due to typos.
- The new `AdmissionControlSubsystem` metrics subsystem string uses `"admission_control"` while most external identifiers (service name, labels) use a hyphen; consider aligning this naming (or documenting the difference) to reduce confusion when querying metrics across subsystems.

## Individual Comments

### Comment 1
<location path="image/templates/helm/stackrox-secured-cluster/templates/admission-controller-netpol.yaml" line_range="61-45" />
<code_context>
+    auto-upgrade.stackrox.io/component: "sensor"
+  annotations:
+    {{- include "srox.annotations" (list . "networkpolicy" "admission-control-monitoring-tls") | nindent 4 }}
+spec:
+  ingress:
+  - ports:
+    - port: 9091
+      protocol: TCP
+  podSelector:
+    matchLabels:
+      app: admission-control
+  policyTypes:
+    - Ingress
+{{- end }}
</code_context>
<issue_to_address>
**🚨 suggestion (security):** NetworkPolicy allows metrics ingress from all sources; consider constraining to Prometheus/monitoring namespaces.

This NetworkPolicy defines ingress on port 9091 with a `podSelector` but no `from` clause, so any pod in any namespace can reach this metrics endpoint. If possible, scope ingress with `namespaceSelector`/`podSelector` to only the OpenShift monitoring/Prometheus pods that scrape these metrics.

Suggested implementation:

```
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: admission-control-monitoring-tls
  namespace: {{ ._rox._namespace }}
  labels:
    {{- include "srox.labels" (list . "networkpolicy" "admission-control-monitoring-tls") | nindent 4 }}
spec:
  podSelector:
    matchLabels:
      app: admission-control
  policyTypes:
    - Ingress
  ingress:
    - from:
        - namespaceSelector:
            matchExpressions:
              - key: kubernetes.io/metadata.name
                operator: In
                values:
                  - openshift-monitoring
                  - openshift-user-workload-monitoring
      ports:
        - port: 9091
          protocol: TCP
</code>

```

1. Ensure the first `NetworkPolicy` in this file (the one before the `{{- if ._rox.monitoring.openshift.enabled }}` block) either has equivalent scoping or is clearly for a different purpose; if it also exposes port 9091 for monitoring traffic, you likely want the same `from` restrictions there as well.
2. Verify that the label `app: admission-control` matches the actual pod labels for the admission controller; if your deployment uses different labels (e.g., `app.kubernetes.io/name`), adjust the `podSelector` accordingly.
3. If your cluster uses different namespaces for Prometheus/monitoring, update the `values` under `kubernetes.io/metadata.name` to match those namespaces.
</issue_to_address>