build: add guarded Kubernetes plane executor

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a02878-7c21-7692-bcd6-ce2838c4b448

manifests/whitehat-plane/network-policy.yaml

@@ -0,0 +1,40 @@
+# CONTRACT ONLY. Do not apply from this repository.
+# Default deny in namespace whitehat; live E2 adds a named egress rule per
+# registered target. This example names audit-core only as the currently
+# applicable live E2 target.
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: default-deny
+  namespace: whitehat
+spec:
+  podSelector: {}
+  policyTypes: ["Ingress", "Egress"]
+---
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: allow-audit-core-e2
+  namespace: whitehat
+spec:
+  podSelector:
+    matchLabels:
+      whitehat.security/target: audit-core
+  policyTypes: ["Egress"]
+  egress:
+    - to:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: audit-core
+      ports:
+        - protocol: TCP
+          port: 8080
+    - to:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: kube-system
+      ports:
+        - protocol: UDP
+          port: 53
+        - protocol: TCP
+          port: 53