fix: use CiliumNetworkPolicy for kube-apiserver egress

Standard K8s NetworkPolicy ipBlock rules don't work under Cilium for
the API server — the except clause on 192.168.1.0/24 blocks the
post-DNAT destination even when a separate rule re-allows the subnet.

Cilium's native kube-apiserver entity tracks API server endpoints
regardless of ClusterIP vs node-IP routing.

Replaces: ipBlock 192.168.1.0/24:6443 (broken under Cilium)
With: CiliumNetworkPolicy toEntities: kube-apiserver (works)

k8s/infra/forgejo-runner/templates/networkpolicy.yaml

@@ -29,16 +29,6 @@ spec:
             except:
               - 192.168.1.0/24
               - 10.244.0.0/16
-    # Kubernetes API server — CI needs kubectl access to create
-    # Tekton PipelineRuns for integration testing.
-    # The API server runs on control-plane nodes (192.168.1.0/24);
-    # we allow port 6443 only to that subnet.
-    - to:
-        - ipBlock:
-            cidr: 192.168.1.0/24
-      ports:
-        - protocol: TCP
-          port: 6443
     # ingress-nginx, which is how forgejo.riotpiao.com resolves (CoreDNS
     # rewrites that name to ingress-nginx-controller.ingress-nginx.svc).
     # Image pushes go to that name so the tag matches what containerd pulls