Operate scheduled chain-head attestation (AUDIT-WP-0009-T12)

Apply the separate attestor identity, named-ConfigMap RBAC, attest
egress and daily CronJob. Bootstrap an empty chain-head ConfigMap
only because it was absent; drop the placeholder from the apply path
so a later apply cannot overwrite a live head. One-shot job published
a 59-event attestation; mounted readback and receiver write-denial
passed. Offsite copy stays the operator path.

Assistant: grok
Assistant-Session: 01a0a182-bab7-7f11-b32b-d06f3af52082

deploy/networkpolicies.yaml

@@ -199,10 +199,10 @@ spec:
       ports:
         - {protocol: UDP, port: 53}
         - {protocol: TCP, port: 53}
-    # kube-apiserver. On this single-node k3s cluster the API server is the
-    # host itself, so this is a host-network destination rather than a pod
-    # selector; narrow it to the API port.
+    # kube-apiserver. In-cluster clients use kubernetes.default.svc:443;
+    # the host listener is 6443. Both, and no other ports.
     - ports:
+        - {protocol: TCP, port: 443}
         - {protocol: TCP, port: 6443}
 ---
 apiVersion: networking.k8s.io/v1