Fix invalid Cilium default-deny directions #214

🤖 Generated by the Agentic Engineer

Problem

The template carries two incompatible default-deny shapes. The direct oauth2-proxy policy renders ingress: [] and egress: [], which the Cilium agent rejects. The namespace-wide Kyverno generator instead emits explicit ingressDeny and egressDeny rules, which take precedence over the workload allow policies that should reopen required traffic. A freshly scaffolded platform therefore does not get a valid, composable network-isolation floor.

The matching Platform repair is tracked in devantler-tech/platform#3501 and implemented by devantler-tech/platform#4381. Its disposable Cilium 1.20.2 proof passed for the corrected [{}] shape, including allowed DNS and explicitly allowed HTTP plus denied ingress, egress, and target HTTP.

Acceptance criteria

• Every scaffolded default-deny Cilium policy uses the valid [{}] ingress and egress shape.
• Comments describe the present Cilium semantics without migration history.
• A regression test rejects empty direction lists and proves the real template manifests satisfy the contract.
• Both local and production template validation pass.

Part of #67.