fix(net): renderer emits world/internet egress allow per egress class + fix jackett/plex tags

Root cause the media stack surfaced: the default-deny baseline is DNS-only egress (correct for
R-NET-01 east-west), but the egress CLASS (internet/vpn) had no policy ALLOWING north-south
egress — so qbittorrent/sonarr/radarr couldn't reach the internet at all (VPN downloaders
broken). Add an additive per-app CiliumNetworkPolicy '<app>-allow-internet-egress' with
toEntities:[world] (non-cluster); the egress-class steering + kill-switch (ADR-0015) govern the
PATH (internet=WAN, vpn=tun0). East-west stays denied except declared dependencies; R-NET-01
baseline unchanged. Re-rendered all apps + regenerated L1 goldens. Also fixed jackett + plex
image tags (bad pins -> :latest; Renovate/update policy pins later).

conformance/tests/l1-rendering/container-workload-render/golden/expected.yaml

@@ -98,6 +98,22 @@ spec:
       - port: '8080'
         protocol: TCP
 ---
+# CiliumNetworkPolicy world egress allow (egress class governs the path; R-NET-05): paas-demo-allow-internet-egress
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: paas-demo-allow-internet-egress
+  namespace: paas-demo
+  labels:
+    app.kubernetes.io/name: paas-demo
+spec:
+  endpointSelector:
+    matchLabels:
+      app.kubernetes.io/name: paas-demo
+  egress:
+  - toEntities:
+    - world
+---
 # HTTPRoute paas-demo-8080 (R-TLS/R-DNS)
 apiVersion: gateway.networking.k8s.io/v1
 kind: HTTPRoute

conformance/tests/l1-rendering/default-deny-baseline-render/golden/expected.yaml

@@ -56,6 +56,22 @@ spec:
       - name: baseline-demo
         image: nginx:1.27
 ---
+# CiliumNetworkPolicy world egress allow (egress class governs the path; R-NET-05): baseline-demo-allow-internet-egress
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: baseline-demo-allow-internet-egress
+  namespace: baseline-demo
+  labels:
+    app.kubernetes.io/name: baseline-demo
+spec:
+  endpointSelector:
+    matchLabels:
+      app.kubernetes.io/name: baseline-demo
+  egress:
+  - toEntities:
+    - world
+---
 # ServiceMonitor (R-OBS-01)
 apiVersion: monitoring.coreos.com/v1
 kind: ServiceMonitor

conformance/tests/l1-rendering/egress-class-render/golden/egress-internet.expected.yaml

@@ -123,6 +123,22 @@ spec:
       - port: '8989'
         protocol: TCP
 ---
+# CiliumNetworkPolicy world egress allow (egress class governs the path; R-NET-05): sonarr-allow-internet-egress
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: sonarr-allow-internet-egress
+  namespace: sonarr
+  labels:
+    app.kubernetes.io/name: sonarr
+spec:
+  endpointSelector:
+    matchLabels:
+      app.kubernetes.io/name: sonarr
+  egress:
+  - toEntities:
+    - world
+---
 # HTTPRoute sonarr-8989 (R-TLS/R-DNS)
 apiVersion: gateway.networking.k8s.io/v1
 kind: HTTPRoute

conformance/tests/l1-rendering/egress-class-render/golden/egress-vpn.expected.yaml

@@ -123,6 +123,22 @@ spec:
       - port: '8989'
         protocol: TCP
 ---
+# CiliumNetworkPolicy world egress allow (egress class governs the path; R-NET-05): sonarr-allow-internet-egress
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: sonarr-allow-internet-egress
+  namespace: sonarr
+  labels:
+    app.kubernetes.io/name: sonarr
+spec:
+  endpointSelector:
+    matchLabels:
+      app.kubernetes.io/name: sonarr
+  egress:
+  - toEntities:
+    - world
+---
 # HTTPRoute sonarr-8989 (R-TLS/R-DNS)
 apiVersion: gateway.networking.k8s.io/v1
 kind: HTTPRoute