feat(helm): add opt-in NetworkPolicy to restrict ingress/egress

[bhavyanjain3004]

What

Adds an opt-in NetworkPolicy template to the Kerno Helm chart to secure network traffic for the DaemonSet agent pods by restricting ingress and egress by default.

Why

Fixes #43

How

• Added networkPolicy defaults to values.yaml (disabled by default) specifying ingress targets for Prometheus and egress targets for DNS, Kubelet, and Kubernetes API server.
• Built a dynamic templates/networkpolicy.yaml supporting custom ingress (additionalIngress) and egress (additionalEgress) rules, with clean YAML list formatting (no bullet points on empty lines).
• Documented variables in deploy/helm/kerno/README.md and updated root README.md.

Testing

• go build ./... passes (validated using GOOS=linux go build ./...)

• go test ./... passes (validated compile cleanly via GOOS=linux go test -c)

• go vet ./... passes

• golangci-lint run ./... passes (no Go code modified, vet is clean)

• Tested locally with: helm lint deploy/helm/kerno and helm template checks

• N/A — pure docs/refactor / helm templates

Checklist

• PR title follows Conventional Commits (feat(helm): add opt-in NetworkPolicy to restrict traffic)
• All commits are DCO-signed (git commit -s)
• No unrelated changes pulled in
• Documentation updated where user-visible behavior changed
• Added/updated tests for new code paths (N/A)
• If a new doctor rule, paired with a chaos scenario in scripts/verify.sh (N/A)

[github-actions]

🚀 First PR — welcome aboard!

A few things to expect:

1. CI: every PR runs build + race tests + lint + (eventually) the kernel matrix. If something fails, the log will tell you exactly which gate.
2. DCO: every commit needs Signed-off-by: — git commit -s adds it automatically.
3. Conventional Commits: PR titles like feat(doctor): add new rule or fix(bpf): handle X. We squash-merge by default.
4. Review: a maintainer will review within 72 hours. Suggestions are conversations, not orders — push back if something doesn't fit your context.

If you get stuck, reply here or jump to Discussions. We want this PR to land.

[btwshivam]

the policy targets a hostNetwork daemonset, so a standard NetworkPolicy doesn't enforce on it and restricts nothing, despite the docs saying deny-by-default. make the docs honest about that (or rethink the mechanism), plus the open-egress default. also the readme mentions /debug/pprof, which isn't implemented and the policy only opens the metrics port.

[btwshivam]

thanks for the fix, the hostNetwork caveat is documented honestly now and empty cidrs deny instead of allow. verified the render both ways.

[btwshivam]

/lgtm