feat(cyberchef): networkPolicy.ingress.ambientMesh

Gitea #143. Additive, default false, so the render is byte-identical to the
previous release - proven by diffing both renders rather than asserted.

Switched on it adds 15008/TCP, ztunnel's HBONE tunnel, to the rule carrying
the probe port, and - inside that rule's source-restricted branch -
169.254.7.127/32, the address the kubelet's probes arrive from once the pod is
in the mesh. The two halves are one value because the second is the one nobody
thinks of: 15008 added by hand leaves a policy that passes review and drops
every probe the first time probeSources is narrowed.

Minor, not major: additive value, unchanged default, unchanged render.

cyberchef/templates/cyberchef.networkpolicy.yaml

@@ -51,6 +51,14 @@ selects.
 {{- $allowedNs := $np.allowedNamespaces | default list }}
 {{- $ic := $np.ingressController | default dict }}
 {{- $routed := or .Values.ingress.enabled .Values.httpRoute.enabled }}
+{{- /* networkPolicy.ingress - the policy's INBOUND side, and not the same thing
+       as networkPolicy.ingressController (the SOURCE SELECTOR for the ingress
+       controller's pods, a SIBLING of it and no part of it) nor as the
+       top-level .Values.ingress (the Ingress object). All three match a search
+       for "ingress"; one round of this work already mistook the second for an
+       inbound escape hatch on the strength of the substring. */}}
+{{- $npIngress := $np.ingress | default dict }}
+{{- $ambientMesh := $npIngress.ambientMesh }}
 apiVersion: networking.k8s.io/v1
 kind: NetworkPolicy
 metadata:
@@ -85,6 +93,26 @@ spec:
     - ports:
         - protocol: TCP
           port: 8080
+        {{- if $ambientMesh }}
+        {{- /* FIRST HALF OF networkPolicy.ingress.ambientMesh (Gitea #143). 15008/TCP
+               is ztunnel's HBONE tunnel, the port every inbound connection arrives on
+               once the namespace carries istio.io/dataplane-mode - ambient "does not
+               and will never bypass Kubernetes NetworkPolicy enforcement", so without
+               it a pod in the mesh is simply unreachable.
+
+               It is the one port here that is NOT a containerPort of the selected pod
+               spec: ztunnel terminates it, not the application. ci/run-networkpolicy-
+               test.sh therefore holds a NAMED exception for exactly this number, gated
+               on exactly this value - and assertion 7 of that script proves, on a
+               second render, that 15008 stays the ONLY such port and that it is absent
+               while the value is false.
+
+               NOT MEASURED: that 15008 alone suffices comes from Istio's
+               documentation. Measured on this cluster is only which listeners ztunnel
+               opens. Provable at the first namespace to join the mesh; none has. */}}
+        - protocol: TCP
+          port: 15008
+        {{- end }}
       {{- if $probeSources }}
       {{- /*
       RESTRICTED, because the operator supplied probeSources. The kubelet's probes
@@ -128,6 +156,30 @@ spec:
         - ipBlock:
             cidr: {{ . | quote }}
         {{- end }}
+        {{- if $ambientMesh }}
+        {{- /* SECOND HALF OF networkPolicy.ingress.ambientMesh, and the reason it is
+               one value and not two. Inside the mesh the kubelet's probes are
+               redirected and no longer arrive from the worker node's address: they
+               arrive from 169.254.7.127.
+
+               An operator who only opens 15008 by hand writes a policy that passes
+               review - and the moment probeSources is non-empty every probe is
+               dropped, the pod never becomes Ready, and the symptom reads as a broken
+               application rather than as a policy. That is assertion 4 of
+               ci/run-networkpolicy-test.sh one value further along. A switch whose
+               halves can only be had together cannot be set halfway.
+
+               Only in this branch, because this is the only branch with a "from" list:
+               with no sources restricted the rule is open and needs no peer. The IPv6
+               counterpart is deliberately absent - this cluster is SingleStack IPv4,
+               and an ipBlock of the wrong family is accepted and matches nothing.
+
+               UNPROVEN IN OPERATION: probeSources is empty in every chart here, so no
+               release reaches this branch. CI proves its render, through the overlays
+               in ci/networkpolicy. */}}
+        - ipBlock:
+            cidr: 169.254.7.127/32
+        {{- end }}
       {{- else }}
       {{- /*
       NO "from" SELECTOR, WHICH MEANS OPEN - deliberately, and only inside the