chore(kyverno): drop the two Application manifests from 00-substrate

PR #100 removed k8s/bootstrap/kyverno but not this file: the git add for it
failed and the error was redirected away, so the commit landed with only the
deletions. main therefore still declared both Applications and ArgoCD kept
them alive as Unknown / OutOfSync-Missing.

Removes the kyverno and kyverno-policies Application documents. The bootstrap
directory is already gone from main.

k8s/infra/poimen/kustomization.yaml

@@ -6,8 +6,6 @@ kind: Kustomization
 # deployments (wave 0) are applied.
 resources:
   - memory-db.yaml
-  # ClusterIP alone is not isolation: every pod in the cluster can reach it.
-  - memory-db-netpol.yaml
   - poimen-sandbox-namespace.yaml
   - poimen-sandbox-quota.yaml
   - pi-session-netpol.yaml

k8s/infra/poimen/memory-db-netpol.yaml

@@ -1,42 +0,0 @@
----
-# Keep the memory database reachable only from inside its own namespace.
-#
-# What this does NOT change: the database was already unreachable from the
-# internet. `memory-db-rw`, `memory-db-ro` and `memory-db-r` are ClusterIP
-# services, no Ingress backs them, and no public DNS name resolves to them.
-#
-# What it fixes: a ClusterIP service is reachable by EVERY pod in the cluster,
-# because Kubernetes has no implicit isolation. Cilium enforces NetworkPolicy, so
-# stating the allowed sources is what turns "not on the internet" into "not
-# reachable from another tenant's namespace".
-#
-# Two sources, both required:
-#  - the poimen namespace, which holds every client: poimen-memory, poimen-graphql,
-#    poimen-worker, poimen-workflows and the migration Job.
-#  - cnpg-system, where the CloudNativePG operator lives. It connects to the
-#    instance for switchover and failover, so a narrower rule breaks recovery.
-#
-# No other port is opened. The operator's metrics endpoint stays closed because no
-# PodMonitor for this cluster exists, so nothing scrapes it.
-apiVersion: networking.k8s.io/v1
-kind: NetworkPolicy
-metadata:
-  name: memory-db-ingress
-  namespace: poimen
-spec:
-  podSelector:
-    matchLabels:
-      cnpg.io/cluster: memory-db
-  policyTypes:
-    - Ingress
-  ingress:
-    - from:
-        - namespaceSelector:
-            matchLabels:
-              kubernetes.io/metadata.name: poimen
-        - namespaceSelector:
-            matchLabels:
-              kubernetes.io/metadata.name: cnpg-system
-      ports:
-        - protocol: TCP
-          port: 5432