fix(net): renderer emits world/internet egress allow per egress class + fix jackett/plex tags

Root cause the media stack surfaced: the default-deny baseline is DNS-only egress (correct for
R-NET-01 east-west), but the egress CLASS (internet/vpn) had no policy ALLOWING north-south
egress — so qbittorrent/sonarr/radarr couldn't reach the internet at all (VPN downloaders
broken). Add an additive per-app CiliumNetworkPolicy '<app>-allow-internet-egress' with
toEntities:[world] (non-cluster); the egress-class steering + kill-switch (ADR-0015) govern the
PATH (internet=WAN, vpn=tun0). East-west stays denied except declared dependencies; R-NET-01
baseline unchanged. Re-rendered all apps + regenerated L1 goldens. Also fixed jackett + plex
image tags (bad pins -> :latest; Renovate/update policy pins later).

apps/plex.yaml

@@ -73,7 +73,7 @@ spec:
     spec:
       containers:
       - name: plex
-        image: plexinc/pms-docker:1.41.3.9314-a0bfa8370
+        image: plexinc/pms-docker:latest
         ports:
         - containerPort: 32400
         volumeMounts:
@@ -120,6 +120,22 @@ spec:
       - port: '32400'
         protocol: TCP
 ---
+# CiliumNetworkPolicy internet/world egress (internet class, R-NET-05): plex-allow-internet-egress
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: plex-allow-internet-egress
+  namespace: plex
+  labels:
+    app.kubernetes.io/name: plex
+spec:
+  endpointSelector:
+    matchLabels:
+      app.kubernetes.io/name: plex
+  egress:
+  - toEntities:
+    - world
+---
 # HTTPRoute plex-32400 (R-TLS/R-DNS)
 apiVersion: gateway.networking.k8s.io/v1
 kind: HTTPRoute