feat(satisfactory): networkPolicy.ingress.ambientMesh

Gitea #143. Additive, default false, so the render is byte-identical to the
previous release - proven by diffing both renders against origin/main rather
than asserted.

Switched on it adds 15008/TCP, ztunnel's HBONE tunnel, to the rule carrying
the probe port, and - inside that rule's source-restricted branch -
169.254.7.127/32, the address the kubelet's probes arrive from once the pod is
in the mesh. Ambient does not bypass NetworkPolicy enforcement, so without the
port a pod whose namespace has joined the mesh is unreachable.

The two halves are one value because the second is the one nobody thinks of:
15008 added by hand leaves a policy that passes review and drops every probe
the first time probeSources is narrowed, and a pod that never becomes Ready
reads as a broken application rather than as a policy.

Minor, not major: additive value, unchanged default, unchanged render.

Port half only: this chart offers no networkPolicy.probeSources - its probes
put no packet on the network - so there is no redirected probe to allow and an
ipBlock for one would match nothing while making the rule look like it did
something. ci/run-networkpolicy-test.sh ties that exemption to the absence of
probeSources, not to a chart name.

satisfactory/templates/satisfactory.networkpolicy.yaml

@@ -57,6 +57,11 @@ every port here against the containerPorts of the pod spec this policy
 selects.
 */ -}}
 {{- if .Values.networkPolicy.enabled }}
+{{- /* networkPolicy.ingress - the policy's INBOUND side, and not the same
+       thing as the top-level .Values.ingress (the Ingress object) - both match
+       a search for "ingress". */}}
+{{- $npIngress := .Values.networkPolicy.ingress | default dict }}
+{{- $ambientMesh := $npIngress.ambientMesh }}
 apiVersion: networking.k8s.io/v1
 kind: NetworkPolicy
 metadata:
@@ -98,4 +103,34 @@ spec:
           port: {{ include "satisfactory.formatNumber" .Values.server.gamePort }}
         - protocol: TCP
           port: {{ include "satisfactory.formatNumber" .Values.server.messagingPort }}
+        {{- if $ambientMesh }}
+        {{- /* networkPolicy.ingress.ambientMesh (Gitea #143). 15008/TCP is ztunnel's
+               HBONE tunnel, the port every inbound connection arrives on once the
+               namespace carries istio.io/dataplane-mode - ambient "does not and will
+               never bypass Kubernetes NetworkPolicy enforcement", so without it a pod
+               in the mesh is unreachable.
+
+               It is the one port here that is NOT a containerPort of the selected pod
+               spec: ztunnel terminates it, not the application. ci/run-networkpolicy-
+               test.sh holds a NAMED exception for exactly this number, gated on exactly
+               this value, and proves on a second render that it stays the only such
+               port and that it is absent while the value is false.
+
+               THE PORT HALF ONLY, and that is not an omission. Elsewhere this switch
+               also adds 169.254.7.127/32 as a probe source, because inside the mesh the
+               kubelet's probes are redirected away from the worker node's address.
+               This chart offers no networkPolicy.probeSources at all, so the rule
+               carrying the probe port is never restricted by source - and an
+               unrestricted rule needs no probe address. The chart's networkPolicy
+               block has nothing but enabled. Measured in the render: two exec probes
+               and one tcpSocket.
+               WHICH RULE IT JOINS:
+               the only rule this policy has, the one carrying the game and messaging
+               ports.
+               NOT MEASURED: that 15008 alone suffices comes from Istio's
+               documentation. Measured on this cluster is only which listeners ztunnel
+               opens. Provable at the first namespace to join the mesh; none has. */}}
+        - protocol: TCP
+          port: 15008
+        {{- end }}
 {{- end }}