[P5] In-pod egress lockdown for injected clients

[jacaudi]

Context

First of two killswitch layers. This one works on any CNI, installed by the sidecar itself inside the pod.

wg-quick's full-tunnel setup already fails closed for AllowedIPs changes — it installs policy routing (ip rule ... table 51820 plus suppress_prefixlength 0) so internet-bound packets cannot use the main table's default route, and WireGuard drops packets matching no peer. This issue is about the cases that routing does not cover.

The trap: an overly broad egress drop will strangle the tunnel it is protecting. WireGuard's own encrypted output must be excepted — that is what the fwmark is for.

Scope

Install in-pod rules restricting egress to the tunnel plus a narrow allow list.

Acceptance criteria

• Non-tunnel egress dropped inside the pod
• WireGuard's own fwmark-tagged output excepted — tunnel still works
• IPv6 denied explicitly (a config covering 0.0.0.0/0 but not ::/0 leaks v6 while looking correct)
• Cluster DNS reachable
• Configurable in-cluster allow list, so app-to-app traffic still works

Depends on #32. See docs/ROADMAP.md § Phase 5.9.