feat(platform): verify local NetworkPolicy enforcement

[zhouning]

Summary

• add a fail-closed local cross-node NetworkPolicy enforcement contract and runner
• verify five cumulative ingress/egress stages on the Docker Desktop two-node kindnet data plane
• commit contract-bound evidence, ADR-045, runtime inventory registration, roadmap/SoR updates, and required CI coverage

Live evidence

• baseline: authorized connected, denied connected
• ingress default-deny: authorized blocked, denied blocked
• ingress selector allow: authorized connected, denied blocked
• egress default-deny: authorized blocked, denied blocked
• DNS plus server TCP/8080 allow: authorized connected, denied blocked
• rehearsal namespace removed; provider, node, and CNI identities preserved

Verification

• 543 required platform tests passed
• 22 focused NetworkPolicy/platform truth tests passed
• frontend production build passed
• static contract, committed evidence integrity, platform truth, and CI YAML validation passed

Boundaries

This is stacked on PR #12. It proves only isolated local cross-node kindnet enforcement. Production NetworkPolicy enforcement, Metadata Fabric provider policy, tenant isolation, OIDC, upgrades, GDA writes, and production readiness remain false.