feat(AUDIT-WP-0008): admit governed E2 probe ingress

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a025c2-407a-7a32-b40a-f37a52f03f62

tests/test_networkpolicies.py

@@ -0,0 +1,26 @@
+from pathlib import Path
+
+
+ROOT = Path(__file__).parents[1]
+
+
+def test_whitehat_ingress_is_bound_to_namespace_and_target_labels():
+    documents = (ROOT / "deploy" / "networkpolicies.yaml").read_text().split("\n---\n")
+    policy = next(
+        document
+        for document in documents
+        if "name: audit-core-whitehat-ingress" in document
+    )
+
+    # Both selectors must remain in the same `from` peer. Splitting them into
+    # two list items changes AND to OR and would admit every pod in either set.
+    expected_peer = """        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: whitehat
+          podSelector:
+            matchLabels:
+              whitehat.security/plane: \"true\"
+              whitehat.security/target: audit-core"""
+    assert expected_peer in policy
+    assert policy.count("        - namespaceSelector:") == 1
+    assert "        - {protocol: TCP, port: 8080}" in policy