refactor(bentopdf): ambientMesh becomes an object carrying Istio's two constants

Gitea #143, maintainer's instruction. The HBONE port and the redirected probe
source are ISTIO CONSTANTS, not standards, so they move from template literals
into values with documented defaults - an operator can then correct them when
Istio changes a number, without waiting for a chart release.

One object under one "enabled", so the two halves still cannot be set
separately; two values could drift apart, which is what this design exists to
prevent. Every read is null-safe (#99), so a deleted object or one carrying
only "enabled: true" falls back to the defaults declared here rather than
dereferencing nil - the defect #136 shipped one value away.

Provenance now written on each constant: 15008 is Istio's HBONE port, not
IANA-registered for this and unknown to Kubernetes; 169.254.7.127 is link-local
(RFC 3927, never routed), its IPv6 counterpart carries the same digits plus
1337, and neither the NetworkPolicy API nor the kubelet knows the address -
only Istio's data plane rewrites the probe source onto it. Both read for
ztunnel 1.30.6, and a change in either fails silently.

The exception in ci/run-networkpolicy-test.sh stays pinned to the numbers that
test names, and additionally asserts this chart declares the same defaults -
never "whatever the value says", which would let a mistyped port in through a
configurable field.

No version change: nothing is published yet, the default is still off, and the
render at defaults is byte-identical - re-diffed against origin/main.

bentopdf/templates/bentopdf.networkpolicy.yaml

@@ -51,7 +51,18 @@ selects.
        for "ingress"; one round of this work already mistook the second for an
        inbound escape hatch on the strength of the substring. */}}
 {{- $npIngress := $np.ingress | default dict }}
-{{- $ambientMesh := $npIngress.ambientMesh }}
+{{- /* NULL-SAFE ON PURPOSE (#99): ambientMesh is an OBJECT, so every read goes
+       through a fallback reproducing THIS chart's declared defaults. An
+       operator who deletes the object, or writes only "enabled: true", must
+       land on the defaults and not in a nil dereference - #136 shipped exactly
+       that defect one value away, where the NOTES.txt branch dereferenced
+       .networkPolicy.egress directly. Clearing the probe-source list restores
+       the constant rather than removing the ipBlock, deliberately: the two
+       halves are not separable, and enabled: false is how you open nothing. */}}
+{{- $ambient := $npIngress.ambientMesh | default dict }}
+{{- $ambientEnabled := $ambient.enabled }}
+{{- $ambientPort := $ambient.port | default 15008 }}
+{{- $ambientProbeSources := $ambient.redirectedProbeSources | default (list "169.254.7.127/32") }}
 apiVersion: networking.k8s.io/v1
 kind: NetworkPolicy
 metadata:
@@ -84,7 +95,7 @@ spec:
     - ports:
         - protocol: TCP
           port: 8080
-        {{- if $ambientMesh }}
+        {{- if $ambientEnabled }}
         {{- /* FIRST HALF OF networkPolicy.ingress.ambientMesh (Gitea #143). 15008/TCP
                is ztunnel's HBONE tunnel, the port every inbound connection arrives on
                once the namespace carries istio.io/dataplane-mode - ambient "does not
@@ -98,11 +109,22 @@ spec:
                second render, that 15008 stays the ONLY such port and that it is absent
                while the value is false.
 
+               AN ISTIO CONSTANT, NOT A STANDARD: 15008 is not registered with
+               IANA for this, no protocol prescribes it, and Kubernetes knows
+               nothing about it - Istio picked it for HBONE and Istio can change
+               it. Hence a VALUE with a documented default rather than a literal
+               here, so an operator can correct it without a chart release. Read
+               for ztunnel 1.30.6. The exception ci/run-networkpolicy-test.sh
+               grants is pinned to the number THAT TEST names, plus a check that
+               this chart declares the same default - never to whatever the value
+               says, because that would let a mistyped port ride in through a
+               configurable field (design A of #143).
+
                NOT MEASURED: that 15008 alone suffices comes from Istio's
                documentation. Measured on this cluster is only which listeners ztunnel
                opens. Provable at the first namespace to join the mesh; none has. */}}
         - protocol: TCP
-          port: 15008
+          port: {{ int $ambientPort }}
         {{- end }}
       {{- if $probeSources }}
       {{- /*
@@ -146,7 +168,7 @@ spec:
         - ipBlock:
             cidr: {{ . | quote }}
         {{- end }}
-        {{- if $ambientMesh }}
+        {{- if $ambientEnabled }}
         {{- /* SECOND HALF OF networkPolicy.ingress.ambientMesh, and the reason it is
                one value and not two. Inside the mesh the kubelet's probes are
                redirected and no longer arrive from the worker node's address: they
@@ -164,11 +186,29 @@ spec:
                counterpart is deliberately absent - this cluster is SingleStack IPv4,
                and an ipBlock of the wrong family is accepted and matches nothing.
 
+               WHERE 169.254.7.127 COMES FROM - vendor magic, not protocol:
+               it is LINK-LOCAL (169.254.0.0/16, RFC 3927), a range reserved for
+               node-local use and never routed; Istio's IPv6 counterpart
+               fd16:9254:7127:1337:ffff:ffff:ffff:ffff carries the SAME DIGITS
+               plus 1337; and KUBERNETES DOES NOT KNOW THE ADDRESS - neither the
+               NetworkPolicy API nor the kubelet - only Istio's data plane
+               rewrites the probe source onto it. Read for ztunnel 1.30.6, and if
+               Istio changes it THE FAILURE IS SILENT: probes dropped, and only
+               where probeSources is non-empty, which is nowhere today.
+
+               A LIST, not a string, and the one case where that does not
+               contradict "a constant, not a configuration": a DUAL-STACK cluster
+               needs BOTH entries at once. This cluster is SingleStack IPv4, so
+               the IPv6 counterpart is left out - an ipBlock of the wrong family
+               is accepted and matches nothing. Add it ALONGSIDE, never instead.
+
                UNPROVEN IN OPERATION: probeSources is empty in every chart here, so no
                release reaches this branch. CI proves its render, through the overlays
                in ci/networkpolicy. */}}
+        {{- range $ambientProbeSources }}
         - ipBlock:
-            cidr: 169.254.7.127/32
+            cidr: {{ . | quote }}
+        {{- end }}
         {{- end }}
       {{- else }}
       {{- /*