refactor(stalwart): ambientMesh becomes an object carrying Istio's two constants

Gitea #143, maintainer's instruction. The HBONE port and the redirected probe
source are ISTIO CONSTANTS, not standards, so they move from template literals
into values with documented defaults - an operator can then correct them when
Istio changes a number, without waiting for a chart release.

One object under one "enabled", so the two halves still cannot be set
separately; two values could drift apart, which is what this design exists to
prevent. Every read is null-safe (#99), so a deleted object or one carrying
only "enabled: true" falls back to the defaults declared here rather than
dereferencing nil - the defect #136 shipped one value away.

Provenance now written on each constant: 15008 is Istio's HBONE port, not
IANA-registered for this and unknown to Kubernetes; 169.254.7.127 is link-local
(RFC 3927, never routed), its IPv6 counterpart carries the same digits plus
1337, and neither the NetworkPolicy API nor the kubelet knows the address -
only Istio's data plane rewrites the probe source onto it. Both read for
ztunnel 1.30.6, and a change in either fails silently.

The exception in ci/run-networkpolicy-test.sh stays pinned to the numbers that
test names, and additionally asserts this chart declares the same defaults -
never "whatever the value says", which would let a mistyped port in through a
configurable field.

No version change: nothing is published yet, the default is still off, and the
render at defaults is byte-identical - re-diffed against origin/main.

stalwart/values.yaml

@@ -590,7 +590,85 @@ networkPolicy:
     # IPs in istio-system (measured: no hostNetwork on the DaemonSet, Istio
     # 1.30.6), so if one proves necessary it is expressible as a
     # namespaceSelector plus podSelector and needs no unknowable node CIDR.
-    ambientMesh: false
+    # BOTH NUMBERS BELOW ARE ISTIO CONSTANTS, NOT STANDARDS, and they are values
+    # rather than template literals for exactly that reason: a vendor constant
+    # can change, and an operator should be able to correct it without waiting
+    # for a chart release. Their provenance is written on each one.
+    #
+    # DELETING THIS OBJECT IS SAFE. Every read falls back to the defaults
+    # declared here (#99), so "ambientMesh: null", or an object carrying only
+    # "enabled: true", renders the documented defaults instead of failing.
+    ambientMesh:
+      # The switch. Everything else here is inert while it is false, and the
+      # chart renders exactly as it did before the object existed.
+      enabled: false
+
+      # ISTIO'S HBONE PORT. A constant Istio chose, not a standard: not
+      # registered with IANA for this, prescribed by no protocol, and unknown to
+      # Kubernetes. Read for ztunnel 1.30.6 (measured on this cluster: ztunnel
+      # opens [::]:15008 as its inbound listener).
+      #
+      # If Istio changes it, a pod in the mesh cannot be reached. Change it here
+      # in all 30 charts AND in the pinned expectation inside
+      # ci/run-networkpolicy-test.sh - the test is deliberately what forces
+      # someone to look, because the exception it grants this port is pinned to
+      # the number IT knows and not to whatever this value says. A value-driven
+      # exception would let a mistyped port through, which is the hole design A
+      # of #143 was rejected for.
+      #
+      # NOT MEASURED: that this port ALONE suffices comes from Istio's
+      # documentation. Measured here is only which listeners ztunnel opens, and
+      # no namespace carries istio.io/dataplane-mode yet.
+      port: 15008
+
+      # SOURCES THE KUBELET'S PROBES ARRIVE FROM ONCE ISTIO HAS REDIRECTED THEM.
+      #
+      # NOT THE SAME VALUE AS networkPolicy.probeSources one level up, and the
+      # two are easy to confuse, so:
+      #
+      #   networkPolicy.probeSources
+      #       YOUR worker node CIDRs. Empty by default, and empty means the
+      #       probe rule is OPEN. The chart cannot know these addresses.
+      #   networkPolicy.ingress.ambientMesh.redirectedProbeSources
+      #       ISTIO's rewrite address. Shipped filled, because unlike the node
+      #       IPs it is a constant the chart CAN know. Only rendered where the
+      #       rule above is restricted, i.e. where probeSources is non-empty.
+      #
+      # WHERE 169.254.7.127 COMES FROM - vendor magic, not protocol:
+      #
+      #   - LINK-LOCAL, 169.254.0.0/16 (RFC 3927): a range reserved for
+      #     node-local use that is never routed - exactly the range one picks a
+      #     vendor's magic address out of.
+      #   - Istio's IPv6 counterpart gives it away:
+      #     fd16:9254:7127:1337:ffff:ffff:ffff:ffff carries the SAME DIGITS
+      #     (9254:7127 is 169.254.7.127) plus 1337. Numbers built that way are
+      #     vendor constants, not protocols.
+      #   - KUBERNETES DOES NOT KNOW THIS ADDRESS. Neither the NetworkPolicy API
+      #     nor the kubelet has any notion of it; only Istio's own data plane
+      #     rewrites the probe source onto it.
+      #
+      # Read for ztunnel 1.30.6. IF ISTIO CHANGES IT, THE FAILURE IS SILENT:
+      # probes would be dropped, and only where probeSources is non-empty - which
+      # is nowhere in this repository today - so nothing here and nothing in
+      # Kubernetes would report it. What to re-check then: the address Istio's
+      # release notes name for probe redirection, this list in all 30 charts, and
+      # the pinned expectation in ci/run-networkpolicy-test.sh.
+      #
+      # A LIST, not a string, and the one case where that does not contradict "a
+      # constant, not a configuration": on a DUAL-STACK cluster BOTH entries are
+      # needed at the same time, not one of two. This cluster is SingleStack
+      # IPv4, so the IPv6 counterpart is left out - an ipBlock of the wrong
+      # family is accepted by the API server and matches nothing. Add it
+      # ALONGSIDE, never instead, if the cluster gains IPv6.
+      #
+      # Clearing this list restores the default rather than removing the ipBlock,
+      # deliberately: the two halves of this switch are not separable. To not
+      # open the port at all, set enabled: false.
+      #
+      # UNPROVEN IN OPERATION: probeSources is empty in every chart here, so no
+      # release reaches this branch. CI proves the render, not the effect.
+      redirectedProbeSources:
+        - 169.254.7.127/32
 
   # Egress is restricted BY PORT, not by destination, and the reason is a limit
   # of the object rather than laziness: a NetworkPolicy matches ipBlock CIDRs