netpol: wave 1 — six deploy and helper workloads lose their outbound (#0088)

matrix-rtc-authorisation-service, wikijs-config, init-secrets,
synapse-check-config and both deployment markers have no demonstrable need
to leave the cluster. They now get DNS plus the pod and service networks
and nothing else.

The name goes into BOTH lists, and that is the whole point: NetworkPolicies
are additive, so as long as the broad policy still selects a pod and allows
0.0.0.0/0, a second and stricter rule for the same pod changes nothing. The
file already carried that warning as a comment; this change obeys it rather
than rediscovering it.

Checked before pushing: both selector lists are congruent - no workload is
excluded from the broad rule without receiving the narrow one, and none the
other way round. A one-sided entry would either open a pod completely or
cut it off entirely, and neither shows up as a syntax error.

Class A is deliberately the first wave: these workloads run at deploy time,
so a mistake surfaces at the next rollout rather than in a user's face.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01F2Q4Ri8NGwyTZzScvKnWFM

apps/production/networkpolicy.yaml

@@ -461,6 +461,13 @@ spec:
           - wikijs-gruppenpruefung
           - haproxy
           - draupnir
+          # Welle 1 (#0088): kein externer Bedarf nachweisbar.
+          - matrix-rtc-authorisation-service
+          - wikijs-config
+          - init-secrets
+          - synapse-check-config
+          - deployment-markers-pre
+          - deployment-markers-post
       - key: app
         operator: NotIn
         values:
@@ -526,6 +533,13 @@ spec:
           - wikijs-gruppenpruefung
           - haproxy
           - draupnir
+          # Welle 1 (#0088): Deploy- und Hilfs-Arbeitslasten.
+          - matrix-rtc-authorisation-service
+          - wikijs-config
+          - init-secrets
+          - synapse-check-config
+          - deployment-markers-pre
+          - deployment-markers-post
   policyTypes:
     - Egress
   egress: