feat(AUDIT-WP-0008): admit governed E2 probe ingress

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a025c2-407a-7a32-b40a-f37a52f03f62

deploy/networkpolicies.yaml

@@ -37,6 +37,32 @@ spec:
 ---
 apiVersion: networking.k8s.io/v1
 kind: NetworkPolicy
+metadata:
+  name: audit-core-whitehat-ingress
+  namespace: audit-core
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/name: audit-core
+  policyTypes: [Ingress]
+  ingress:
+    # Governed E2 evidence plane. Both selectors belong to one peer and are
+    # therefore ANDed: only the registered audit-core probe in the dedicated
+    # whitehat namespace reaches this port. Application sender authentication
+    # and tenant scope remain the inner boundary.
+    - from:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: whitehat
+          podSelector:
+            matchLabels:
+              whitehat.security/plane: "true"
+              whitehat.security/target: audit-core
+      ports:
+        - {protocol: TCP, port: 8080}
+---
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
 metadata:
   name: audit-core-operator-ingress
   namespace: audit-core