Retire fleet-infra's old NetworkPolicies only once deploy-kit's are enforced #669

What is decided (2026-10-26)

fleet-infra's leftover old-path NetworkPolicies for immich, hindsight, karakeep and overleaf stay, because they are the only enforced segmentation those namespaces have. They are removed in the same change that starts enforcing deploy-kit's own policies for those Projects, never before.

What to build

In that change: delete the four namespaces' hand-written policies from fleet-infra, and prove each Project's rendered policies are enforced (a denied connection is refused, an allowed one answers).