fix(render): namespace-pin east-west selectors so declared deps actually connect

Follow-up to the reciprocal-ingress fix: in-cluster verification (Hubble) revealed
the east-west path was STILL fully blocked — and that the pre-existing EGRESS half
was also broken, contrary to the original diagnosis. Root cause: a CiliumNetworkPolicy
`toEndpoints`/`fromEndpoints` selector is scoped to the POLICY's OWN namespace unless
it carries the reserved `k8s:io.kubernetes.pod.namespace` label. Every service lives
in its own namespace (== its name) and every dependency crosses a namespace boundary,
so an app-label-only peer selector matched nothing and Cilium silently denied the flow
(Hubble: sonarr->qbittorrent = "EGRESS DENIED ... Policy denied DROPPED").

Pin the peer namespace on BOTH halves — egress toEndpoints (destination ns == dep.to)
and the reciprocal ingress fromEndpoints (source ns == source name). This is a strict
TIGHTENING (more precise, still L3/L4), not a weakening. Verified end-to-end in-cluster:
sonarr->qbittorrent:8080, sonarr->jackett:9117, seerr->{sonarr:8989,radarr:7878,
plex:32400} now CONNECT (were DROPPED); undeclared sonarr->plex:32400 and
seerr->qbittorrent:8080 stay BLOCKED (default-deny holds).

Selftest + L0 (17/17) + L1 (3/3, goldens byte-identical) + lint all pass. NOTE: this
necessarily touches the egress toEndpoints selector, which the task scoped as
ingress-only; the premise that egress already worked was empirically false.

Co-Authored-By: Claude Opus 4.8 <[email protected]>

apps/jackett.yaml

@@ -121,6 +121,7 @@ spec:
   - fromEndpoints:
     - matchLabels:
         app.kubernetes.io/name: radarr
+        k8s:io.kubernetes.pod.namespace: radarr
     toPorts:
     - ports:
       - port: '9117'
@@ -142,6 +143,7 @@ spec:
   - fromEndpoints:
     - matchLabels:
         app.kubernetes.io/name: sonarr
+        k8s:io.kubernetes.pod.namespace: sonarr
     toPorts:
     - ports:
       - port: '9117'

apps/plex.yaml

@@ -118,6 +118,7 @@ spec:
   - fromEndpoints:
     - matchLabels:
         app.kubernetes.io/name: seerr
+        k8s:io.kubernetes.pod.namespace: seerr
     toPorts:
     - ports:
       - port: '32400'

apps/qbittorrent.yaml

@@ -121,6 +121,7 @@ spec:
   - fromEndpoints:
     - matchLabels:
         app.kubernetes.io/name: radarr
+        k8s:io.kubernetes.pod.namespace: radarr
     toPorts:
     - ports:
       - port: '8080'
@@ -142,6 +143,7 @@ spec:
   - fromEndpoints:
     - matchLabels:
         app.kubernetes.io/name: sonarr
+        k8s:io.kubernetes.pod.namespace: sonarr
     toPorts:
     - ports:
       - port: '8080'

apps/radarr.yaml

@@ -121,6 +121,7 @@ spec:
   - toEndpoints:
     - matchLabels:
         app.kubernetes.io/name: qbittorrent
+        k8s:io.kubernetes.pod.namespace: qbittorrent
     toPorts:
     - ports:
       - port: '8080'
@@ -142,6 +143,7 @@ spec:
   - toEndpoints:
     - matchLabels:
         app.kubernetes.io/name: jackett
+        k8s:io.kubernetes.pod.namespace: jackett
     toPorts:
     - ports:
       - port: '9117'
@@ -163,6 +165,7 @@ spec:
   - fromEndpoints:
     - matchLabels:
         app.kubernetes.io/name: seerr
+        k8s:io.kubernetes.pod.namespace: seerr
     toPorts:
     - ports:
       - port: '7878'

apps/seerr.yaml

@@ -118,6 +118,7 @@ spec:
   - toEndpoints:
     - matchLabels:
         app.kubernetes.io/name: sonarr
+        k8s:io.kubernetes.pod.namespace: sonarr
     toPorts:
     - ports:
       - port: '8989'
@@ -139,6 +140,7 @@ spec:
   - toEndpoints:
     - matchLabels:
         app.kubernetes.io/name: radarr
+        k8s:io.kubernetes.pod.namespace: radarr
     toPorts:
     - ports:
       - port: '7878'
@@ -160,6 +162,7 @@ spec:
   - toEndpoints:
     - matchLabels:
         app.kubernetes.io/name: plex
+        k8s:io.kubernetes.pod.namespace: plex
     toPorts:
     - ports:
       - port: '32400'

apps/sonarr.yaml

@@ -121,6 +121,7 @@ spec:
   - toEndpoints:
     - matchLabels:
         app.kubernetes.io/name: qbittorrent
+        k8s:io.kubernetes.pod.namespace: qbittorrent
     toPorts:
     - ports:
       - port: '8080'
@@ -142,6 +143,7 @@ spec:
   - toEndpoints:
     - matchLabels:
         app.kubernetes.io/name: jackett
+        k8s:io.kubernetes.pod.namespace: jackett
     toPorts:
     - ports:
       - port: '9117'
@@ -163,6 +165,7 @@ spec:
   - fromEndpoints:
     - matchLabels:
         app.kubernetes.io/name: seerr
+        k8s:io.kubernetes.pod.namespace: seerr
     toPorts:
     - ports:
       - port: '8989'