### What happened?

Applied CRD:

```yaml
openAPIV3Schema:
        type: object
        properties:
          duration:
            type: string
            format: duration
            "x-kubernetes-validations":
            - rule: "self >= duration(\"60m\")"
              message: "duration must be at least 1 hour"
```

Created policy with following rule:

```yaml
  validations:
    - expression: "object.duration >= duration(\"2h\")"
      message: "duration must be at least 2 hours"
```

Applied instances of CRD:

```yaml
apiVersion: example.com/v1
kind: Thing
metadata:
  name: example-thing
duration: 2h
---
apiVersion: example.com/v1
kind: Thing
metadata:
  name: bad-thing
duration: 5m
```

Correctly received error from CRD rule for `bad-thing`, incorrectly received error for `good-thing` on policy due to missing overload for `>=` operator:

```console
❯ kubectl apply -f ./instance.yaml
Error from server (Invalid): error when creating "./instance.yaml": things.example.com "example-thing" is forbidden: ValidatingAdmissionPolicy 'example-policy.example.com' with binding 'example-binding.example.com' denied request: expression 'object.duration >= duration("2h")' resulted in error: no such overload
Error from server (Invalid): error when creating "./instance.yaml": Thing.example.com "bad-thing" is invalid: duration: Invalid value: "string": duration must be at least 1 hour
```


This is because CRDValidationRules consider the schema when representing the object in CEL, while VAP directly exposes the unstructured serialization. i.e.  a `duration`-format `string` in a CRD is represented in CEL using a CEL `duration`, but in VAP it is represented using a `string`

https://github.com/kubernetes/kubernetes/blob/e1b0bc3d0a7fb89a1e60f4ec1ee34b10de22d00a/staging/src/k8s.io/apiserver/pkg/admission/plugin/cel/filter.go#L158-L174

https://github.com/kubernetes/kubernetes/blob/1453085b44ff96b10ab25b68ce34929829114521/staging/src/k8s.io/apiextensions-apiserver/pkg/apiserver/schema/cel/validation.go#L786-L804

### What did you expect to happen?

VAP expressions and CRD rules to work the same way on the same objects in CEL

### How can we reproduce it (as minimally and precisely as possible)?

https://gist.github.com/alexzielenski/db4faa6cb26a6b31dc967fa18dc79199

### Anything else we need to know?

_No response_

### Kubernetes version

1.30

### Cloud provider

N/A

### OS version

Tested using kind 1.30

### Install tools

N/A

### Container runtime (CRI) and version (if applicable)

N/A

### Related plugins (CNI, CSI, ...) and versions (if applicable)

N/A
ValidatingAdmissionPolicy objects have different runtime type compared to CRDValidationRules
This is a GitHub Issue
repo:kubernetes
owner:kubernetes
Title : ValidatingAdmissionPolicy objects have different runtime type compared to CRDValidationRules
Issue date:

--- start body ---
### What happened?

Applied CRD:

```yaml
openAPIV3Schema:
        type: object
        properties:
          duration:
            type: string
            format: duration
            "x-kubernetes-validations":
            - rule: "self >= duration(\"60m\")"
              message: "duration must be at least 1 hour"
```

Created policy with following rule:

```yaml
  validations:
    - expression: "object.duration >= duration(\"2h\")"
      message: "duration must be at least 2 hours"
```

Applied instances of CRD:

```yaml
apiVersion: example.com/v1
kind: Thing
metadata:
  name: example-thing
duration: 2h
---
apiVersion: example.com/v1
kind: Thing
metadata:
  name: bad-thing
duration: 5m
```

Correctly received error from CRD rule for `bad-thing`, incorrectly received error for `good-thing` on policy due to missing overload for `>=` operator:

```console
❯ kubectl apply -f ./instance.yaml
Error from server (Invalid): error when creating "./instance.yaml": things.example.com "example-thing" is forbidden: ValidatingAdmissionPolicy 'example-policy.example.com' with binding 'example-binding.example.com' denied request: expression 'object.duration >= duration("2h")' resulted in error: no such overload
Error from server (Invalid): error when creating "./instance.yaml": Thing.example.com "bad-thing" is invalid: duration: Invalid value: "string": duration must be at least 1 hour
```


This is because CRDValidationRules consider the schema when representing the object in CEL, while VAP directly exposes the unstructured serialization. i.e.  a `duration`-format `string` in a CRD is represented in CEL using a CEL `duration`, but in VAP it is represented using a `string`

https://github.com/kubernetes/kubernetes/blob/e1b0bc3d0a7fb89a1e60f4ec1ee34b10de22d00a/staging/src/k8s.io/apiserver/pkg/admission/plugin/cel/filter.go#L158-L174

https://github.com/kubernetes/kubernetes/blob/1453085b44ff96b10ab25b68ce34929829114521/staging/src/k8s.io/apiextensions-apiserver/pkg/apiserver/schema/cel/validation.go#L786-L804

### What did you expect to happen?

VAP expressions and CRD rules to work the same way on the same objects in CEL

### How can we reproduce it (as minimally and precisely as possible)?

https://gist.github.com/alexzielenski/db4faa6cb26a6b31dc967fa18dc79199

### Anything else we need to know?

_No response_

### Kubernetes version

1.30

### Cloud provider

N/A

### OS version

Tested using kind 1.30

### Install tools

N/A

### Container runtime (CRI) and version (if applicable)

N/A

### Related plugins (CNI, CSI, ...) and versions (if applicable)

N/A
--- end body ---
