Prepare guarded cadence registry updates and Qonto receiver admission

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a13eab-1e6a-7b33-9c37-372e90ada3a2

deploy/qonto-collector-ingress.yaml

@@ -0,0 +1,25 @@
+# NK-WP-0035 / AUDIT-WP-0013-T05. Prepared, not applied.
+# Namespace and pod selectors are ANDed within one peer. Collector egress
+# and credential binding remain independently required.
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: audit-core-qonto-collector-ingress
+  namespace: audit-core
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/name: audit-core
+      app.kubernetes.io/component: receiver
+  policyTypes: [Ingress]
+  ingress:
+    - from:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: rapp-qonto
+          podSelector:
+            matchLabels:
+              app.kubernetes.io/name: rapp-qonto-audit-collector
+      ports:
+        - protocol: TCP
+          port: 8080