fix: match namespaces by kubernetes.io/metadata.name in netpol egress

kube-system and llm-serving carry only the automatic label, so DNS and
upstream egress matched nothing and every dispatch failed with 502.

k8s/network-policy.yaml

@@ -34,15 +34,17 @@ spec:
   - to:
     - namespaceSelector:
         matchLabels:
-          name: kube-system
+          kubernetes.io/metadata.name: kube-system
     ports:
     - protocol: UDP
       port: 53
+    - protocol: TCP
+      port: 53
   # Allow to upstreams (LLM services in llm-serving namespace)
   - to:
     - namespaceSelector:
         matchLabels:
-          name: llm-serving
+          kubernetes.io/metadata.name: llm-serving
     ports:
     - protocol: TCP
       port: 80
@@ -54,7 +56,7 @@ spec:
   - to:
     - namespaceSelector:
         matchLabels:
-          name: llm-serving
+          kubernetes.io/metadata.name: llm-serving
     ports:
     - protocol: TCP
       port: 8080
@@ -62,7 +64,7 @@ spec:
   - to:
     - namespaceSelector:
         matchLabels:
-          name: atlas
+          kubernetes.io/metadata.name: atlas
     ports:
     - protocol: TCP
       port: 8080