Constant KUBE_KEY_MATCH_LABELS 

pub const KUBE_KEY_MATCH_LABELS: &'static str;

Canonical K8s LabelSelector.matchLabels nested-axis key. Re-export of the canonical caixa_core::KUBE_KEY_MATCH_LABELS so the per-CR selector-axis retrieval key lives in exactly one place across every caixa renderer — caixa-mesh’s cilium_policies_are_identity_based (the endpointSelector.matchLabels presence pin + the ingress[0].fromEndpoints[0].matchLabels two-axis-selector pin that check the pleme.pleme.io/program + pleme.pleme.io/aplicacao identity keys the Cilium data plane matches on), the cilium_endpoint_selector_is_program_only destination-selector-axis pin (single-axis LABEL_PROGRAM-only selector — the destination-endpointSelector.matchLabels retrieval whose selector.len() == 1 assertion pins the program-only semantic the canonical pleme_program_selector helper emits), and the cilium_from_endpoints_carries_aplicacao_scoped_selector source- selector-axis pin (two-axis LABEL_PROGRAM + LABEL_APLICACAO selector — the source-fromEndpoints[0].matchLabels retrieval whose from.len() == 2 assertion pins the program-in-Aplicacao-scoped semantic the canonical pleme_program_in_aplicacao_selector helper emits, guarding the safety property that a same-named program in a different Aplicacao cannot satisfy the policy’s ingress rule) now consult the same &'static str as the peer caixa-core-side label_selector production emitter (which already inserts KUBE_KEY_MATCH_LABELS under caixa-core/src/render.rs:7112 on every {matchLabels: <mapping>} envelope the typed selector helpers emit). The prior four inline "matchLabels" literals at every drift-detection / selector-axis test-side site in this crate would have let a typo on any one site (e.g. "MatchLabels", "match_labels", "match-labels", the canonical camelCase-drift "matchlabels" — the K8s apiserver’s OpenAPI v3 schema property name is strict camelCase matchLabels) silently miss the per-CR selector-mapping retrieval — the .get("matchLabels") chain would then return None under the presence pin so the true selector-axis drift never surfaces, or the surrounding .expect("endpointSelector.matchLabels mapping") / .expect("fromEndpoints[0].matchLabels mapping") panic-message tag would fire with the mapping-shape message rather than the true selector-key drift, or the selector.len() == 1 / from.len() == 2 axis-count assertion would compare against the wrong retrieval so the destination-program-only / source-program- in-Aplicacao selector-shape contract’s true drift is masked. The lift routes every K8s-LabelSelector.matchLabels-axis retrieval through the same &'static str so drift between any two sites becomes a single-edit fix at the caixa-core const definition. Extends the per-K8s-CR top-level (apiVersion, kind, metadata, spec) axis re-export quartet + the load-bearing nested metadata.{name, namespace, labels} triplet onto the load-bearing nested LabelSelector.matchLabels axis — the equality-projection axis every rendered CiliumNetworkPolicy document carries at both spec.endpointSelector.matchLabels (the destination-identity selector the Cilium data plane matches pod-identity keys against) and spec.ingress[*].fromEndpoints[*].matchLabels (the source- identity selector the same data plane checks on the admitted- source side). Peer to the sibling load-bearing nested LabelSelector.matchLabels axis re-exports every downstream consumer of the rendered mesh bundle keys off (the Cilium operator’s per-CNP endpointSelector and per-ingress-rule fromEndpoints navigate the same K8s-LabelSelector-schema projection). Canonical K8s API key naming the matchLabels axis of a LabelSelector — the equality-based projection of the selector schema (the other axis, matchExpressions, is set-based and intentionally out-of-scope for the V0 label_selector helper). Spelled exactly as the K8s apiserver expects (camelCase matchLabels, not match_labels / MatchLabels / match-labels) so the rendered YAML round-trips through every K8s schema parser (Cilium CRDs, Gateway API, ComputeUnit, future mesh.pleme.io/v1alpha1/Aplicacao) without per-renderer string drift.