Allow excluding queries and reports from GitOps management

[tux234]

• Unpacked: TODO: Head of Product Design (HPD) checks this box when the request goes through "Unpacking the why": https://fleetdm.com/handbook/product-design#unpacking-the-why
• Gong snippet: TODO

Interpretation

How do you interpret the customer's words?
The prospect saw that Fleet recently shipped GitOps mode exceptions for labels, software, and enroll secrets (#40171), and is asking whether the exception list will be expanded to cover queries and reports. Their detection and response (D&R) team manages queries through its own CI pipelines, separate from the IT team's GitOps repo. Today, if the IT team enables GitOps without specifying queries/reports in YAML, the GitOps run wipes out the D&R team's queries and the reports those queries produce. Duplicating the D&R team's queries into the IT GitOps repo defeats the purpose of the D&R team owning their own pipeline.

What's Fleet missing?
The current GitOps exceptions feature (software, labels, secrets) does not include queries or reports. There is no way to mark "queries are managed outside GitOps" so a different system (the D&R team's CI) can own them without GitOps stomping on changes between syncs.

What does the customer's ideal workflow look like?

1. Global admin enables GitOps for the org and defines most resources in the IT team's Git repo as usual.
2. In the GitOps mode change-management settings (same UI as GitOps mode exceptions: Manage software, labels, and secrets outside of git #40171), admin checks new exception boxes for Queries and Reports.
3. With the exception enabled, GitOps runs that don't specify queries: / leave reports unspecified will leave existing queries and reports untouched instead of wiping them.
4. The D&R team continues to push and update queries via their own CI pipeline against the Fleet API without interference.
5. Both GitOps-managed resources and the D&R team's externally-managed queries/reports coexist on the Fleet instance without conflict.

Related issues

• GitOps mode exceptions: Manage software, labels, and secrets outside of git #40171 — GitOps mode exceptions: Manage software, labels, and secrets outside of git (parent feature)
• Allow excluding specific configuration profiles from GitOps management #44790 — Allow excluding specific configuration profiles from GitOps management (same pattern, different resource — third-party tool ownership)
• Track and surface the human author for GitOps-managed resources (queries, reports, policies, scripts) #44918 — Track and surface the human author for GitOps-managed resources (queries, reports, policies, scripts)