Please address the comments from this code review:

## Overall Comments
- Both namespace label lookup methods (`NamespaceStore.LookupNamespaceLabelsByID` and `namespaceStore.LookupNamespaceLabelsByID`) return the underlying label map directly; consider returning a cloned map to avoid accidental mutation of shared state by callers.
- In `settingsToConfigMap`, you always marshal/compress cluster labels even when the map is nil or empty; consider skipping `ClusterLabelsGZDataKey` in that case to reduce configmap size and align with the `len(data) == 0` fast-path in `decompressAndUnmarshalClusterLabels`.

Please address the comments from this code review:

## Overall Comments
- In `enrichDeploymentWithNamespaceID`, logging a warning for every deployment that lacks a namespace ID could be very noisy in misconfigured clusters; consider downgrading this to debug level or adding some form of rate limiting so logs remain usable.
- Both `ClusterLabelProviderAdapter.GetClusterLabels` and the namespace label providers return the underlying label maps directly; if there is any chance that callers might mutate these maps, it would be safer to return shallow copies to avoid data races or unintended shared state between the stores and the policy engine.

## Individual Comments

### Comment 1
<location path="sensor/common/admissioncontroller/settings_manager_impl.go" line_range="163-160" />
<code_context>
 		})
 	}
+
+	for _, ns := range p.namespaces.GetAll() {
+		ret = append(ret, &sensor.AdmCtrlUpdateResourceRequest{
+			Action: central.ResourceAction_CREATE_RESOURCE,
+			Resource: &sensor.AdmCtrlUpdateResourceRequest_Namespace{
+				Namespace: ns,
+			},
+		})
+	}
 	return ret
</code_context>
<issue_to_address>
**issue (bug_risk):** Guard against nil NamespaceStore to avoid panics in GetResourcesForSync

This adds a dependency on `p.namespaces` being non-nil. While `NewSettingsManager` wires this correctly, tests or other constructors could still pass a nil `NamespaceStore`, causing `p.namespaces.GetAll()` to panic. Please either guard this loop with a nil check or enforce a non-nil `NamespaceStore` invariant in the constructor.
</issue_to_address>

### Comment 2
<location path="sensor/admission-control/manager/manager_impl.go" line_range="45" />
<code_context>
 	)
 )

+// clusterLabelProviderAdapter adapts admission control's static cluster labels to the ClusterLabelProvider interface.
+type clusterLabelProviderAdapter struct {
+	labels map[string]string
</code_context>
<issue_to_address>
**issue (complexity):** Consider reusing the shared label provider adapters from the common package instead of defining local adapter types to keep the abstraction centralized and avoid duplication.

You can drop the local adapter types and reuse the shared adapters from `sensor/common/labelproviders` to avoid duplicate concepts and keep the wiring local.

```go
// Remove these local types entirely:
// - clusterLabelProviderAdapter
// - namespaceLabelProviderAdapter
```

Then, in the wiring code, construct the providers via the shared helpers:

```go
import (
    // ...
    "github.com/stackrox/rox/sensor/common/labelproviders"
)

// ...

// Wire label providers for admission control policies.
clusterLabelProvider := labelproviders.NewClusterLabelProviderAdapter(
    newSettings.GetClusterLabels(),
)

namespaceLabelProvider := labelproviders.NewNamespaceLabelProviderAdapter(
    // lookupFunc: namespaceID -> (labels, found)
    m.namespaces.LookupNamespaceLabelsByID,
)

allK8sEventPolicies := detection.NewPolicySet(clusterLabelProvider, namespaceLabelProvider)
deployFieldK8sEventPolicies, k8sEventOnlyPolicies :=
    detection.NewPolicySet(clusterLabelProvider, namespaceLabelProvider),
    detection.NewPolicySet(clusterLabelProvider, namespaceLabelProvider)

// ...

// Wire label providers for deploy-time policies.
specOnlyPolicies := detection.NewPolicySet(clusterLabelProvider, namespaceLabelProvider)
enrichmentRequiredPolicies := detection.NewPolicySet(clusterLabelProvider, namespaceLabelProvider)

compiled, err := detection.CompilePolicy(policy, clusterLabelProvider, namespaceLabelProvider)
```

This keeps all functionality intact while eliminating redundant adapter implementations and centralizing the label-provider abstraction in one package.
</issue_to_address>

### Comment 3
<location path="sensor/common/labelproviders/providers.go" line_range="10" />
<code_context>
+)
+
+// ClusterLabelProviderAdapter adapts Sensor's cluster labels store to the ClusterLabelProvider interface.
+type ClusterLabelProviderAdapter struct {
+	store *clusterlabels.Store
+}
</code_context>
<issue_to_address>
**issue (complexity):** Consider refactoring these label adapter structs into shared function-based adapters so that all callers use a single, unified abstraction for cluster and namespace labels.

You can reduce the “fragmented abstraction surface” by making this package the *only* place that defines these adapters and by simplifying the adapters to be reusable function adapters. That lets `sensor/admission-control/manager/manager_impl.go` stop defining its own nearly identical types.

### 1. Replace struct adapters with function adapters

Instead of a dedicated `NamespaceLabelProviderAdapter` struct that wraps a `lookupFunc`, make the function type itself implement the interface. This removes one level of indirection and makes it trivial for callers (like the manager) to use existing functions directly.

```go
package labelproviders

import (
    "context"

    "github.com/stackrox/rox/sensor/common/clusterlabels"
)

// --- Cluster labels ---

// ClusterLabelProviderFunc adapts a function to the ClusterLabelProvider interface.
type ClusterLabelProviderFunc func(ctx context.Context, clusterID string) (map[string]string, error)

func (f ClusterLabelProviderFunc) GetClusterLabels(ctx context.Context, clusterID string) (map[string]string, error) {
    return f(ctx, clusterID)
}

// NewClusterLabelProviderAdapter adapts clusterlabels.Store to ClusterLabelProvider.
func NewClusterLabelProviderAdapter(store *clusterlabels.Store) ClusterLabelProviderFunc {
    return func(_ context.Context, _ string) (map[string]string, error) {
        return store.Get(), nil
    }
}

// --- Namespace labels ---

// NamespaceLabelProviderFunc adapts a function to the NamespaceLabelProvider interface.
type NamespaceLabelProviderFunc func(ctx context.Context, namespaceID string) (map[string]string, error)

func (f NamespaceLabelProviderFunc) GetNamespaceLabels(ctx context.Context, namespaceID string) (map[string]string, error) {
    return f(ctx, namespaceID)
}

// NewNamespaceLabelProviderAdapter adapts a lookup func to NamespaceLabelProvider.
func NewNamespaceLabelProviderAdapter(lookupFunc func(string) (map[string]string, bool)) NamespaceLabelProviderFunc {
    return func(_ context.Context, namespaceID string) (map[string]string, error) {
        labels, found := lookupFunc(namespaceID)
        if !found {
            return nil, nil
        }
        return labels, nil
    }
}
```

### 2. Remove local adapter types in the manager

In `sensor/admission-control/manager/manager_impl.go`, replace local adapter structs with the function types above and/or directly use the constructors:

```go
// Before: local adapter type in manager_impl.go
type namespaceLabelProviderAdapter struct {
    lookupFunc func(string) (map[string]string, bool)
}

func (a *namespaceLabelProviderAdapter) GetNamespaceLabels(ctx context.Context, nsID string) (map[string]string, error) {
    labels, found := a.lookupFunc(nsID)
    if !found {
        return nil, nil
    }
    return labels, nil
}
```

```go
// After: use shared adapter
import "github.com/stackrox/rox/sensor/admission-control/labelproviders"

// wherever the provider is created:
nsProvider := labelproviders.NewNamespaceLabelProviderAdapter(manager.lookupNamespaceLabels)
```

Do the same for cluster labels:

```go
// Before: local cluster adapter type
type clusterLabelProviderAdapter struct {
    store *clusterlabels.Store
}

func (a *clusterLabelProviderAdapter) GetClusterLabels(ctx context.Context, _ string) (map[string]string, error) {
    return a.store.Get(), nil
}
```

```go
// After: use shared adapter
import "github.com/stackrox/rox/sensor/admission-control/labelproviders"

clusterProvider := labelproviders.NewClusterLabelProviderAdapter(clusterLabelStore)
```

### 3. Outcome

- All adapter logic lives in `labelproviders`, eliminating parallel, nearly identical types.
- Callers (including the manager) just pass their existing lookup functions/stores into the shared constructors.
- The abstraction surface is unified: one way to adapt label sources to the interfaces, no duplicated adapter types.
</issue_to_address>