fix(infra): add DNS + GitLab + pushgateway + registry to training netpol

argo-training-workflow was missing DNS egress (port 53), causing
MinIO hostname resolution to timeout. Also missing GitLab SSH (2222),
GitLab API (8181), Pushgateway (9091), and Registry (5000).

Now matches the gpu-test-workflow netpol which works correctly.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

infra/k8s/argo/argo-workflow-netpol.yaml

@@ -12,6 +12,12 @@ spec:
   policyTypes:
     - Egress
   egress:
+    # DNS — required for hostname resolution (minio, gitlab, etc.)
+    - ports:
+        - port: 53
+          protocol: UDP
+        - port: 53
+          protocol: TCP
     # Kubernetes API — Argo executor reports task results
     - ports:
         - port: 443
@@ -23,7 +29,29 @@ spec:
             cidr: 10.32.0.0/16
         - ipBlock:
             cidr: 172.16.0.4/32
-    # MinIO — binary fetch + result upload
+    # HTTPS (external registries, etc.)
+    - ports:
+        - port: 443
+          protocol: TCP
+    # GitLab SSH — git clone
+    - ports:
+        - port: 2222
+          protocol: TCP
+      to:
+        - ipBlock:
+            cidr: 100.90.76.85/32
+        - podSelector:
+            matchLabels:
+              app: gitlab-shell
+    # GitLab API — binary fetch from packages
+    - ports:
+        - port: 8181
+          protocol: TCP
+      to:
+        - podSelector:
+            matchLabels:
+              app: webservice
+    # MinIO — log archival + result upload
     - ports:
         - port: 9000
           protocol: TCP
@@ -31,6 +59,14 @@ spec:
         - podSelector:
             matchLabels:
               app.kubernetes.io/name: minio
+    # Pushgateway — Prometheus metrics
+    - ports:
+        - port: 9091
+          protocol: TCP
+      to:
+        - podSelector:
+            matchLabels:
+              app.kubernetes.io/name: pushgateway
     # Tempo — OTLP traces
     - ports:
         - port: 4317
@@ -47,6 +83,14 @@ spec:
         - podSelector:
             matchLabels:
               app.kubernetes.io/name: mattermost
+    # Container registry — image pulls
+    - ports:
+        - port: 5000
+          protocol: TCP
+      to:
+        - podSelector:
+            matchLabels:
+              app: registry
 ---
 # Compile workflow pods: need GitLab SSH, MinIO, k8s API, external HTTPS (cargo deps)
 apiVersion: networking.k8s.io/v1