chore(kyverno): drop the two Application manifests from 00-substrate

PR #100 removed k8s/bootstrap/kyverno but not this file: the git add for it
failed and the error was redirected away, so the commit landed with only the
deletions. main therefore still declared both Applications and ArgoCD kept
them alive as Unknown / OutOfSync-Missing.

Removes the kyverno and kyverno-policies Application documents. The bootstrap
directory is already gone from main.

k8s/infra/poimen/graphql-netpol.yaml

@@ -1,28 +0,0 @@
----
-# Keep the GraphQL server reachable only from the one service that proxies it.
-#
-# poimen-graphql is already off the internet: its Service is ClusterIP on 8090 and
-# no Ingress names it. What it lacked is in-cluster isolation — a ClusterIP answers
-# every pod in the cluster.
-#
-# The only caller is poimen-memory, whose /graphql route forwards the request body
-# to MEM_GQL_PORT (8090). No other workload references this service.
-apiVersion: networking.k8s.io/v1
-kind: NetworkPolicy
-metadata:
-  name: poimen-graphql-ingress
-  namespace: poimen
-spec:
-  podSelector:
-    matchLabels:
-      app.kubernetes.io/name: poimen-graphql
-  policyTypes:
-    - Ingress
-  ingress:
-    - from:
-        - podSelector:
-            matchLabels:
-              app.kubernetes.io/name: poimen-memory
-      ports:
-        - protocol: TCP
-          port: 8090

k8s/infra/poimen/kustomization.yaml

@@ -6,10 +6,6 @@ kind: Kustomization
 # deployments (wave 0) are applied.
 resources:
   - memory-db.yaml
-  # ClusterIP alone is not isolation: every pod in the cluster can reach it.
-  - memory-db-netpol.yaml
-  # Only poimen-memory's /graphql proxy calls 8090.
-  - graphql-netpol.yaml
   - poimen-sandbox-namespace.yaml
   - poimen-sandbox-quota.yaml
   - pi-session-netpol.yaml

k8s/infra/poimen/memory-db-netpol.yaml

@@ -1,42 +0,0 @@
----
-# Keep the memory database reachable only from inside its own namespace.
-#
-# What this does NOT change: the database was already unreachable from the
-# internet. `memory-db-rw`, `memory-db-ro` and `memory-db-r` are ClusterIP
-# services, no Ingress backs them, and no public DNS name resolves to them.
-#
-# What it fixes: a ClusterIP service is reachable by EVERY pod in the cluster,
-# because Kubernetes has no implicit isolation. Cilium enforces NetworkPolicy, so
-# stating the allowed sources is what turns "not on the internet" into "not
-# reachable from another tenant's namespace".
-#
-# Two sources, both required:
-#  - the poimen namespace, which holds every client: poimen-memory, poimen-graphql,
-#    poimen-worker, poimen-workflows and the migration Job.
-#  - cnpg-system, where the CloudNativePG operator lives. It connects to the
-#    instance for switchover and failover, so a narrower rule breaks recovery.
-#
-# No other port is opened. The operator's metrics endpoint stays closed because no
-# PodMonitor for this cluster exists, so nothing scrapes it.
-apiVersion: networking.k8s.io/v1
-kind: NetworkPolicy
-metadata:
-  name: memory-db-ingress
-  namespace: poimen
-spec:
-  podSelector:
-    matchLabels:
-      cnpg.io/cluster: memory-db
-  policyTypes:
-    - Ingress
-  ingress:
-    - from:
-        - namespaceSelector:
-            matchLabels:
-              kubernetes.io/metadata.name: poimen
-        - namespaceSelector:
-            matchLabels:
-              kubernetes.io/metadata.name: cnpg-system
-      ports:
-        - protocol: TCP
-          port: 5432