fix(kyverno): correct default-deny-shape to require both Ingress+Egress via deny.conditions (scalar-array pattern was inverted)

Co-Authored-By: Claude Opus 4.8 <[email protected]>

platform/kyverno/policies/validate-default-deny-shape.yaml

@@ -36,8 +36,12 @@ spec:
         message: >-
           A default-deny baseline NetworkPolicy must set spec.policyTypes to include
           BOTH Ingress and Egress (R-NET-01, docs/03).
-        pattern:
+        deny:
-          spec:
+          conditions:
-            policyTypes:
+            any:
-              - Ingress
+              - key: Ingress
-              - Egress
+                operator: AnyNotIn
+                value: "{{ request.object.spec.policyTypes || `[]` }}"
+              - key: Egress
+                operator: AnyNotIn
+                value: "{{ request.object.spec.policyTypes || `[]` }}"