refactor(valkey): ambientMesh becomes an object carrying Istio's two constants

Gitea #143, maintainer's instruction. The HBONE port and the redirected probe
source are ISTIO CONSTANTS, not standards, so they move from template literals
into values with documented defaults - an operator can then correct them when
Istio changes a number, without waiting for a chart release.

One object under one "enabled", so the two halves still cannot be set
separately; two values could drift apart, which is what this design exists to
prevent. Every read is null-safe (#99), so a deleted object or one carrying
only "enabled: true" falls back to the defaults declared here rather than
dereferencing nil - the defect #136 shipped one value away.

Provenance now written on each constant: 15008 is Istio's HBONE port, not
IANA-registered for this and unknown to Kubernetes; 169.254.7.127 is link-local
(RFC 3927, never routed), its IPv6 counterpart carries the same digits plus
1337, and neither the NetworkPolicy API nor the kubelet knows the address -
only Istio's data plane rewrites the probe source onto it. Both read for
ztunnel 1.30.6, and a change in either fails silently.

The exception in ci/run-networkpolicy-test.sh stays pinned to the numbers that
test names, and additionally asserts this chart declares the same defaults -
never "whatever the value says", which would let a mistyped port in through a
configurable field.

No version change: nothing is published yet, the default is still off, and the
render at defaults is byte-identical - re-diffed against origin/main.

No redirectedProbeSources here, in neither values.yaml nor the schema: this
chart offers no networkPolicy.probeSources, so its probe rule is never
source-restricted and no ipBlock is ever rendered. The key would reach no rule
and read as a control that does nothing, which is worse than one that is
absent. ci/run-networkpolicy-test.sh asserts that absence rather than
tolerating it.

valkey/templates/valkey.networkpolicy.yaml

@@ -36,7 +36,15 @@ a port that is genuinely closed to everything but the namespaces named below.
        thing as the top-level .Values.ingress (the Ingress object) - both match
        a search for "ingress". */}}
 {{- $npIngress := .Values.networkPolicy.ingress | default dict }}
-{{- $ambientMesh := $npIngress.ambientMesh }}
+{{- /* NULL-SAFE ON PURPOSE (#99): ambientMesh is an OBJECT, so every read goes
+       through a fallback reproducing THIS chart's declared defaults. An
+       operator who deletes the object, or writes only "enabled: true", must
+       land on the defaults and not in a nil dereference - #136 shipped exactly
+       that defect one value away, where the NOTES.txt branch dereferenced
+       .networkPolicy.egress directly. */}}
+{{- $ambient := $npIngress.ambientMesh | default dict }}
+{{- $ambientEnabled := $ambient.enabled }}
+{{- $ambientPort := $ambient.port | default 15008 }}
 apiVersion: networking.k8s.io/v1
 kind: NetworkPolicy
 metadata:
@@ -73,7 +81,7 @@ spec:
       ports:
         - protocol: TCP
           port: 6379
-        {{- if $ambientMesh }}
+        {{- if $ambientEnabled }}
         {{- /* networkPolicy.ingress.ambientMesh (Gitea #143). 15008/TCP is ztunnel's
                HBONE tunnel, the port every inbound connection arrives on once the
                namespace carries istio.io/dataplane-mode - ambient "does not and will
@@ -104,10 +112,21 @@ spec:
                expressible as a namespaceSelector plus podSelector and not as an
                unknowable node CIDR. It cannot be settled before a namespace joins the
                mesh, and none has.
+               AN ISTIO CONSTANT, NOT A STANDARD: 15008 is not registered with
+               IANA for this, no protocol prescribes it, and Kubernetes knows
+               nothing about it - Istio picked it for HBONE and Istio can change
+               it. Hence a VALUE with a documented default rather than a literal
+               here, so an operator can correct it without a chart release. Read
+               for ztunnel 1.30.6. The exception ci/run-networkpolicy-test.sh
+               grants is pinned to the number THAT TEST names, plus a check that
+               this chart declares the same default - never to whatever the value
+               says, because that would let a mistyped port ride in through a
+               configurable field (design A of #143).
+
                NOT MEASURED: that 15008 alone suffices comes from Istio's
                documentation. Measured on this cluster is only which listeners ztunnel
                opens. Provable at the first namespace to join the mesh; none has. */}}
         - protocol: TCP
-          port: 15008
+          port: {{ int $ambientPort }}
         {{- end }}
 {{- end }}