Validate Task/Step result names against internal reserved names (`ExitCode`, `StartedAt`, `Reason`)

[vdemeester]

Problem

entrypointer.go writes internal bookkeeping entries (Key: "ExitCode", Key: "StartedAt", Key: "Reason" with ResultType: InternalTektonResultType) and user-declared Task/Step results into the same []result.RunResult termination message array, distinguished only by ResultType.

If a Task author declares a result named ExitCode, StartedAt, or Reason, the user result collides with the internal entry. Depending on ordering, the internal value may be overwritten, causing incorrect status reporting for the Step.

Impact

Self-inflicted confusion only — the Task author controls their own result names. No cross-tenant or security impact.

Proposed Fix

Add webhook validation to reject Task and StepAction result names that collide with internal reserved names:

var reservedResultNames = sets.NewString("ExitCode", "StartedAt", "Reason")

// In Task/StepAction validation:
if reservedResultNames.Has(result.Name) {
    errs = errs.Also(apis.ErrInvalidValue(
        fmt.Sprintf("%q is a reserved result name", result.Name),
        fmt.Sprintf("results[%d].name", i),
    ))
}

Context

Reported via a security advisory (closed as not a security vulnerability — self-harm only, no privilege escalation).

/kind bug
/area api