hermes: let the scm broker actually reach the forge ingress

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

services/hermes-scm-broker/networkpolicy.yaml

@@ -48,5 +48,14 @@ spec:
     - to:
         - ipBlock:
             cidr: 192.168.22.9/32
+        # Pod egress to the forge VIP is DNAT-ed to the ingress pods before
+        # policy evaluation, so the VIP ipBlock alone never matches; allow the
+        # ingress pods themselves or every broker->forge read is rejected.
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: traefik
+          podSelector:
+            matchLabels:
+              app.kubernetes.io/name: traefik
       ports:
         - {protocol: TCP, port: 443}