hermes(chat): allow tenant egress to the apiserver for cluster_read

The read-only cluster_read tool (and the HUX-12 producer) reach the
Kubernetes API through the kubernetes Service, which kube-proxy DNATs
from the 10.43.0.1 ClusterIP to a control-plane node on 192.168.22.11-13
:6443 - addresses the tenant egress except-block was dropping, so calls
failed with connection-refused. Egress now allows the ClusterIP and
those three apiserver endpoints on 443/6443. RBAC still bounds what is
readable (no Secrets); nothing else about the isolation changes.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01BvMSXH8VH2tMWXanb8SJdf

services/hermes/networkpolicy.yaml

@@ -406,13 +406,23 @@ spec:
       ports:
         - {protocol: TCP, port: 9005}
         - {protocol: TCP, port: 9009}
-    # HUX-12 evidence producer: the Kubernetes API (ClusterIP) for pod and
-    # Flux facts, and the ingress edge for Jenkins/Harbor/health receipts.
+    # Read-only Kubernetes API for the cluster_read tool and the HUX-12
+    # producer: the ClusterIP (some CNIs match pre-DNAT) and the real
+    # control-plane apiserver endpoints on 6443 (post-DNAT target; the
+    # 192.168/16 except-block below would otherwise drop these), plus the
+    # ingress edge for Jenkins/Harbor/health receipts.
     - to:
         - ipBlock:
             cidr: 10.43.0.1/32
+        - ipBlock:
+            cidr: 192.168.22.11/32
+        - ipBlock:
+            cidr: 192.168.22.12/32
+        - ipBlock:
+            cidr: 192.168.22.13/32
       ports:
         - {protocol: TCP, port: 443}
+        - {protocol: TCP, port: 6443}
     - to:
         - namespaceSelector:
             matchLabels: