fix(infra): add NetworkPolicy for data-download jobs, fix pod labels

The download job pod was missing app.kubernetes.io/part-of: foxhunt,
so the default-deny-all egress policy blocked it and MinIO's ingress
policy rejected it. Also removed hostname pinning (was a misdiagnosis).

Added data-download-job NetworkPolicy allowing egress to MinIO:9000
and external HTTPS:443 (Databento API).

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

infra/k8s/network-policies/data-download-job.yaml

@@ -0,0 +1,36 @@
+# Egress policy for data-download jobs (MBP-10 download, etc.)
+# Allows: MinIO (upload), Databento API (HTTPS download)
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: data-download-job
+  namespace: foxhunt
+  labels:
+    app.kubernetes.io/part-of: foxhunt
+spec:
+  podSelector:
+    matchLabels:
+      foxhunt/job-type: data-download
+  policyTypes:
+    - Egress
+  egress:
+    # MinIO — binary fetch + data upload
+    - to:
+        - podSelector:
+            matchLabels:
+              app.kubernetes.io/name: minio
+      ports:
+        - protocol: TCP
+          port: 9000
+    # Databento API (HTTPS)
+    - to:
+        - ipBlock:
+            cidr: 0.0.0.0/0
+            except:
+              - 10.0.0.0/8
+              - 172.16.0.0/12
+              - 192.168.0.0/16
+              - 100.64.0.0/10
+      ports:
+        - protocol: TCP
+          port: 443

infra/k8s/training/download-mbp10-job.yaml

@@ -35,6 +35,7 @@ spec:
     metadata:
       labels:
         app.kubernetes.io/name: download-mbp10
+        app.kubernetes.io/part-of: foxhunt
         foxhunt/job-type: data-download
     spec:
       nodeSelector: