docs: the NetworkPolicy convention and its render test

README gains two sections and CLAUDE.md the binding compact summary.

"NetworkPolicies (#5)" under Chart style guidelines carries the part that is
actually hard to get right: the FOUR PORT CLASSES, and that the class decides
the rule. A port a network probe addresses stays open until probeSources is
set, because the kubelet probes from the worker node's IP and no chart can know
it. A NodePort-published port stays open because the source is already
masqueraded. Everything else can be - and is - restricted by source, which is
why the charts with a real inbound restriction are exactly the ones whose
probes use a different port: keycloak's 8080, garage's s3 and web,
minecraft-server's RCON, teamspeak-server's query interface. And a cluster bus
between a release's own replicas gets a bare podSelector, with the reminder
that policyTypes Egress means the outbound side needs its own rule or the
cluster never forms while every node looks healthy.

The exec-probe distinction is written down as load-bearing rather than
pedantic, because it is the whole reason valkey and minecraft-server are the
tightest policies here and every HTTP-probed web app is looser.

What the policies do NOT do has its own list, including the two that will
surprise someone: most dependency ports are the STANDARD ones rather than the
configured ones, because connection details live in 1Password items the charts
never parse - with keycloak, stalwart and minecraft-router named as the
exceptions that derive theirs from values; and a subchart's pods are not
covered, with ytdlp-web-player's oauth2-proxy as the sharp case and
paperless-ngx' valkey as the opposite.

The three Ingress-only charts are listed with their individual arguments rather
than a blanket excuse, and gotenberg is contrasted against them: it keeps a
DNS-only cap on purpose, because it drives a headless Chromium on a port the
whole cluster can reach.

"NetworkPolicy render test" under CI/CD documents the gate, and ends with what
the pipeline cannot prove - including the measurement from this PR that k3s
exempts kubelet probe traffic from policy, so the install-test's net is an
EGRESS net. That is stated there rather than implied, because it is the reason
assertion 2 matters: a wrong ingress port is caught mechanically or not at all.

Part of #5

CLAUDE.md

@@ -116,6 +116,7 @@ The binding style guide for all current and future charts lives in **README.md (
 - Every container offers an additive `env` block rendered through `tpl` with `value`, `secretKeyRef`, and `configMapKeyRef` forms.
 - Hardening: `automountServiceAccountToken: false`, non-root, `readOnlyRootFilesystem: true`, caps dropped, `allowPrivilegeEscalation: false`; contexts values-configurable (`securityContext.pod` / `securityContext.container`); writable paths as emptyDirs; image-forced deviations MUST be documented with a comment in the chart's `values.yaml`.
 - Probes: liveness/readiness/startup on every workload (exception: paperless consume CronJob), values-configurable with calibrated defaults.
+- **Every chart renders a `NetworkPolicy`, `networkPolicy.enabled` defaults to `true`** (#5); adding one to an existing chart is a **major**. Values: `enabled`, `allowedNamespaces`, `probeSources`, `ingressController`, `egress.extraPorts` — and only the ones that actually reach a rule, because a value that does nothing reads as a control. Each port falls in one of four classes and the class decides the rule: a port a **network** probe addresses stays open (`no from`) until `probeSources` is set, because the kubelet probes from the worker node's IP and no chart can know it; a NodePort-published port stays open (the source is already masqueraded); anything else is restricted to the namespace, `allowedNamespaces` and — for HTTP — `ingressController`; a replica-to-replica bus gets a bare `podSelector`. **`exec` probes are not network probes** (no packet, so the port can be restricted — `valkey`, `minecraft-server`). **Pod ports, never NodePorts.** Never `from: []`. Reasoning in Go template comments, never `#` (those ship to the cluster), and such a comment must not spell out its own closing delimiter. Egress is by **port, never destination** — Canal has no FQDN rule and Calico-specific objects are out of scope — so most dependency ports are the *standard* ones and a dependency elsewhere is blocked; `policyTypes` names only what there is something to restrict (`valkey`, `homeassistant`, `satisfactory` are Ingress-only, each argued in its own file). `ci/run-networkpolicy-test.sh` is the gate. Full rules: README, "NetworkPolicies".
 - Resources: requests as values defaults; limits auto-computed by the `_helpers.tpl` helper (`limitFactor` default 3; no CPU limits unless set explicitly).
 - Replicas per workload (explicit `0` allowed) plus a chart-global `scaleDown` flag that overrides them.
 - `icon:` mandatory in every `Chart.yaml`; `helm lint --strict` without findings; CI fixtures under `ci/<chart>/` or a justified exclusion.