feat(ci): assert every rendered NetworkPolicy against its own render

The part that carries the rollout of Gitea #5. 29 charts get a policy that is
on by default, and every way one of them can be wrong is SILENT: the API server
accepts a policy that filters nothing just as readily as one that filters
everything, and neither is a render error, so neither the build nor a rollout
sees it.

ci/run-networkpolicy-test.sh holds every rendered NetworkPolicy against the pod
specs, probes and Services of the SAME render:

  1. the podSelector really matches a pod of that render - otherwise the object
     sits in the namespace, is listed by kubectl, reads as a boundary and
     filters nothing, usually because a label was renamed in another file;
  2. every INGRESS port is a containerPort of the selected pods, which catches
     the NodePort mistake mechanically. Egress ports are deliberately excluded:
     an egress port belongs to the DESTINATION, and comparing it would fail
     every chart that reaches a database;
  3. no ingress rule allows every source by accident. "from: []" always fails -
     it allows everything while reading as a restriction. A MISSING "from" is
     the documented open form and is accepted only where the render justifies
     it: every port of the rule is addressed by a network probe, or published by
     a NodePort Service. That is stricter than the plan's wording, which banned
     both forms, and it had to be, because the precedents use the second one on
     purpose;
  4. the probe path. For every port a NETWORK probe addresses, the policy either
     leaves it unrestricted or the chart offers networkPolicy.probeSources AND
     says in NOTES.txt that a list missing the node's IP leaves the pod
     permanently un-Ready. exec probes are excluded by design - they run inside
     the container and put no packet on the network, which is exactly why
     valkey and minecraft-server can restrict their port by source with no
     probeSources at all.

Two guards beyond the four: a chart that renders NO policy fails, because that
is how this issue decayed in the first place - garage and keycloak were both
created after #5 and both arrived without one. And a "#" comment inside a
rendered policy fails, because it is part of the object and is shipped to the
cluster.

Helm is the parser through ci/yaml2json, as in the other render tests: the
runners have neither pyyaml nor yq, and a hand-written parser could read
nothing, find nothing and leave this green over a chart it never looked at.

Every failure path was run, not just the green ones, and one of them earned its
keep immediately: the probeSources check was a substring test, so a chart whose
key had been deleted while the comment above it still discussed the value
passed. It now looks for the key.

Part of #5

ci/networkpolicy/template-chart.yaml

@@ -0,0 +1,30 @@
+# Overlay for the NetworkPolicy render test (Gitea #5), applied last.
+#
+# Its only job is to render a code path the chart's own defaults never reach:
+# the SOURCE-RESTRICTED ingress rule. With probeSources empty - the default, and
+# deliberately so - the probe port's rule carries no "from" at all, so the whole
+# restricted branch of the template, the one containing the ingress-controller
+# AND, the namespace list and the ipBlock peers, is never rendered and never
+# checked. That branch is also the one with the expensive mistake in it: a
+# namespaceSelector and a podSelector written as two list entries instead of one
+# would be an OR, and would open the port to every pod in kube-system.
+#
+# ci/run-networkpolicy-test.sh FAILS a chart that has an overlay here and still
+# renders no restricted rule. That guard is the point: without it the overlay
+# could silently stop reaching the branch, and the test would stay green over a
+# code path nobody entered.
+#
+# template-chart carries it rather than a real chart because it is installed
+# nowhere (ci/excluded-charts.txt) - so the restricted form is exercised on
+# every pull request with no release depending on these values.
+networkPolicy:
+  # Not the real node addresses of any cluster; a documentation CIDR
+  # (RFC 5737 TEST-NET-1) so nobody can mistake these for something to copy.
+  probeSources:
+    - 192.0.2.11/32
+    - 192.0.2.12/32
+  allowedNamespaces:
+    - monitoring
+  egress:
+    extraPorts:
+      - 5432