feat(samba): networkPolicy.ingress.ambientMesh

Gitea #143. Additive, default false, so the render is byte-identical to the
previous release - proven by diffing both renders against origin/main rather
than asserted.

Switched on it adds 15008/TCP, ztunnel's HBONE tunnel, to the rule carrying
the probe port, and - inside that rule's source-restricted branch -
169.254.7.127/32, the address the kubelet's probes arrive from once the pod is
in the mesh. Ambient does not bypass NetworkPolicy enforcement, so without the
port a pod whose namespace has joined the mesh is unreachable.

The two halves are one value because the second is the one nobody thinks of:
15008 added by hand leaves a policy that passes review and drops every probe
the first time probeSources is narrowed, and a pod that never becomes Ready
reads as a broken application rather than as a policy.

Minor, not major: additive value, unchanged default, unchanged render.

Port half only: this chart offers no networkPolicy.probeSources - its probes
put no packet on the network - so there is no redirected probe to allow and an
ipBlock for one would match nothing while making the rule look like it did
something. ci/run-networkpolicy-test.sh ties that exemption to the absence of
probeSources, not to a chart name.

samba/values.yaml

@@ -128,6 +128,42 @@ networkPolicy:
   # broadcasts on 137/138 UDP are not published by this chart's Service at all,
   # and clients reach the share by address rather than by browse list.
   enabled: true
+
+  # The policy's INBOUND side. Mind the three names that overlap as substrings,
+  # because a search for "ingress" matches all of them and they are different
+  # things:
+  #
+  #   ingress                          (top level) the Ingress OBJECT this chart
+  #                                    renders - host, TLS, className
+  #   networkPolicy.ingress            this block: what the policy lets IN
+  #   networkPolicy.ingressController  the SOURCE SELECTOR for the ingress
+  #                                    controller's pods. A SIBLING of this block
+  #                                    and NO PART OF IT, despite the name.
+  ingress:
+    # Opens the pod for Istio's ambient mesh (Gitea #143). OFF by default and
+    # additive: while it is false this chart renders byte for byte as it did
+    # before the value existed.
+    #
+    # It renders 15008/TCP inbound - ztunnel's HBONE tunnel. Every inbound mesh
+    # connection arrives on it, and ambient "does not and will never bypass
+    # Kubernetes NetworkPolicy enforcement", so without this port a pod whose
+    # namespace has joined the mesh is unreachable.
+    #
+    # ONE HALF SHORTER THAN ELSEWHERE, deliberately. In other charts this switch
+    # also adds 169.254.7.127/32 as a probe source, because inside the mesh the
+    # kubelet's probes are redirected away from the worker node's address. This
+    # chart has no networkPolicy.probeSources at all, so the rule carrying the
+    # probe port is never restricted by source - and an unrestricted rule needs
+    # no probe address. An ipBlock for one would match nothing while making the
+    # rule look like it did something, which is the kind of strict-looking empty
+    # rule ci/run-networkpolicy-test.sh exists to catch; that script ties the
+    # exemption to the absence of probeSources rather than to a chart name.
+    #
+    # NOT PROVEN: that 15008 alone is enough comes from Istio's documentation;
+    # measured on this cluster is only which listeners ztunnel opens, and no
+    # namespace carries istio.io/dataplane-mode yet.
+    ambientMesh: false
+
   egress:
     # Additional outbound TCP ports. DNS (UDP and TCP 53) is always allowed and
     # has no switch - a knob whose only other setting breaks every name lookup