fix: allow CI runner egress to K8s API server (port 6443)

CI needs kubectl access to create Tekton PipelineRuns for integration
testing. The API server runs on control-plane nodes in 192.168.1.0/24
which was blocked by the existing except rule.

Allow port 6443 to 192.168.1.0/24 (control-plane subnet only).

k8s/infra/forgejo-runner/templates/networkpolicy.yaml

@@ -29,6 +29,16 @@ spec:
             except:
               - 192.168.1.0/24
               - 10.244.0.0/16
+    # Kubernetes API server — CI needs kubectl access to create
+    # Tekton PipelineRuns for integration testing.
+    # The API server runs on control-plane nodes (192.168.1.0/24);
+    # we allow port 6443 only to that subnet.
+    - to:
+        - ipBlock:
+            cidr: 192.168.1.0/24
+      ports:
+        - protocol: TCP
+          port: 6443
     # ingress-nginx, which is how forgejo.riotpiao.com resolves (CoreDNS
     # rewrites that name to ingress-nginx-controller.ingress-nginx.svc).
     # Image pushes go to that name so the tag matches what containerd pulls