Complete EMAIL-WP-0004 transactional invitation mail delivery.

Ship the railiance01 deploy package (OpenBao/ESO custody, NetworkPolicy,
probes), provider failure classification and suppression, T04 unit and live
proof, and non-secret NK-WP-0024 hand-back evidence. Workplan finished.

deploy/k8s/railiance/networkpolicies.yaml

@@ -0,0 +1,78 @@
+# Default-deny plus the narrowest exceptions (EMAIL-WP-0004-T03).
+#
+# Reachability is part of the threat model: only user-engine may call the
+# receiver, and egress is limited to DNS + the IONOS SMTP STARTTLS port.
+---
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: email-connect-default-deny
+  namespace: email-connect
+  labels:
+    app.kubernetes.io/name: email-connect
+    app.kubernetes.io/part-of: email-connect
+spec:
+  podSelector: {}
+  policyTypes: [Ingress, Egress]
+  # No rules: everything not permitted below is denied.
+---
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: email-connect-user-engine-ingress
+  namespace: email-connect
+  labels:
+    app.kubernetes.io/name: email-connect
+    app.kubernetes.io/part-of: email-connect
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/name: email-connect
+  policyTypes: [Ingress]
+  ingress:
+    # user-engine is the only approved sender. Adding a second caller is a
+    # deliberate change here and a matching credential binding.
+    - from:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: user-engine
+          podSelector:
+            matchLabels:
+              app.kubernetes.io/name: user-engine
+      ports:
+        - {protocol: TCP, port: 8080}
+---
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: email-connect-egress
+  namespace: email-connect
+  labels:
+    app.kubernetes.io/name: email-connect
+    app.kubernetes.io/part-of: email-connect
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/name: email-connect
+  policyTypes: [Egress]
+  egress:
+    # Cluster DNS
+    - to:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: kube-system
+      ports:
+        - {protocol: UDP, port: 53}
+        - {protocol: TCP, port: 53}
+    # IONOS SMTP STARTTLS only. No general internet egress.
+    # smtp.ionos.de resolves outside the cluster; CIDR is intentionally broad
+    # but port-locked to 587. Tighten to provider CIDRs if inventory is fixed.
+    - to:
+        - ipBlock:
+            cidr: 0.0.0.0/0
+            except:
+              - 10.0.0.0/8
+              - 172.16.0.0/12
+              - 192.168.0.0/16
+      ports:
+        - {protocol: TCP, port: 587}