Constant ALLOW_IDENTITY_CHANGE_ANNOTATION 

pub const ALLOW_IDENTITY_CHANGE_ANNOTATION: &str = "kopiur.home-operations.com/allow-identity-change";

Acknowledges an intentional identity-affecting change on UPDATE. Two surfaces share it:

• a SnapshotPolicy’s own resolved kopia identity (username@hostname, or a source’s path) — see ValidationError::IdentityWouldFork;
• a Repository/ClusterRepository’s identityDefaults (cluster, hostnameExpr, usernameExpr), which every consumer policy relying on those defaults re-resolves against on its next reconcile/backup — see ValidationError::RepositoryIdentityWouldFork.

Without it, the webhook rejects the edit when it would re-identify (a) policy/(consumer policies) with existing snapshot history, because new snapshots land under a new kopia source: restore/verify/fromPolicy resolve the new identity (old history is reachable only via Restore.spec.source.identity), while old- and new-lineage Snapshot CRs keep competing in the policy’s one GFS retention timeline. Any non-empty value acknowledges the re-identification for that admission (presence-only, mirroring SKIP_SNAPSHOT_CLEANUP_ANNOTATION; a specific value isn’t required because an edit can change more than one identity component at once, and the operator-resolved string is not something the author can pre-compute). Lives here because the operator and any GitOps/user automation must agree on it byte-for-byte.