test(ci): prove the install-test enforces NetworkPolicies [EXPERIMENT, reverted next]

The scope of Gitea #5 - 29 charts at once, default on - rests on the claim that
the install-test enforces policies, so a policy that blocks the probe path goes
red in CI rather than silently in production. k3d is created without
--disable-network-policy, but a flag read off a workflow file is not evidence.

This commit restricts cyberchef's probe port 8080 to 192.0.2.11/32, an RFC 5737
documentation address that cannot be the k3d node's IP. The kubelet probes from
the node's own address, so they are dropped and the pod must never become Ready.

Expected: the cyberchef install-test goes RED on rollout status. If it goes
green, policies are not enforced in CI and the scope has to be renegotiated.

Reverted in the next commit either way.

Part of #5

ci/cyberchef/test-values.yaml

@@ -28,6 +28,30 @@ ingress:
   # Ingress switch.
   domain: cyberchef.ci.local
   enabled: false
+
+# TEMPORARY - THIS COMMIT IS AN EXPERIMENT AND IS REVERTED IN THE NEXT ONE.
+#
+# The whole scope of Gitea #5 rests on one claim: that the install-test
+# ENFORCES NetworkPolicies, so a policy which blocks the probe path goes red in
+# CI instead of silently in production. k3d is created without
+# --disable-network-policy, so k3s should bring its policy controller - but
+# "should" read off a flag is not evidence, and 29 charts are about to be
+# switched over on the strength of it.
+#
+# So: 192.0.2.11/32 is a documentation address (RFC 5737 TEST-NET-1). It is
+# NOT the k3d node's IP and cannot be. Setting it restricts cyberchef's probe
+# port 8080 to that one source, which means the kubelet's probes - which come
+# from the node's own address - are dropped.
+#
+# EXPECTED: the pod never becomes Ready and `kubectl rollout status` times out,
+# i.e. the install-test for cyberchef goes RED.
+#
+# If it goes GREEN instead, policies are not enforced in CI, the net under this
+# rollout does not exist, and the scope has to be renegotiated rather than
+# pushed through.
+networkPolicy:
+  probeSources:
+    - 192.0.2.11/32
 httpRoute:
   enabled: true
   # The Gateway does not exist in the CI cluster, and it does not need to: a