fix(k8s): allow minio-init job pods to reach minio via NetworkPolicy

The minio-init-buckets job pod has label app.kubernetes.io/name: minio-init
which doesn't match part-of: foxhunt (adding part-of would trigger
default-deny egress). Add explicit ingress allowlist entry for minio-init
pods on the minio NetworkPolicy.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

infra/k8s/network-policies/infrastructure.yaml

@@ -50,7 +50,7 @@ spec:
         - protocol: TCP
           port: 6379
 ---
-# Minio: accepts connections from foxhunt app pods + GitLab (S3 API)
+# Minio: accepts connections from foxhunt app pods, GitLab, and init jobs
 apiVersion: networking.k8s.io/v1
 kind: NetworkPolicy
 metadata:
@@ -72,6 +72,9 @@ spec:
         - podSelector:
             matchLabels:
               release: gitlab
+        - podSelector:
+            matchLabels:
+              app.kubernetes.io/name: minio-init
       ports:
         - protocol: TCP
           port: 9000