RPF-WP-0047: allow Traefik to reach the cert-manager HTTP-01 solver (8089)

The isolation policy blocked the solver pod, so the challenge got 502.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 150322@bnt-lap001
Assistant-Session: 16a7b788-374e-4915-a1df-fc87ffd9a5e4

argocd/platform-addons/bao-notice/manifests.yaml

@@ -28,6 +28,29 @@ spec:
     - {protocol: TCP, port: 8080}
   egress: []
 ---
+# cert-manager HTTP-01 solver pods run in this namespace on 8089 during
+# issuance and renewal; Traefik must reach them or the challenge gets 502.
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: bao-notice-acme-solver
+  namespace: bao-notice
+spec:
+  podSelector:
+    matchLabels:
+      acme.cert-manager.io/http01-solver: "true"
+  policyTypes: [Ingress]
+  ingress:
+  - from:
+    - namespaceSelector:
+        matchLabels:
+          kubernetes.io/metadata.name: kube-system
+      podSelector:
+        matchLabels:
+          app.kubernetes.io/name: traefik
+    ports:
+    - {protocol: TCP, port: 8089}
+---
 apiVersion: apps/v1
 kind: Deployment
 metadata: