fix(argo): add network policy for compile-and-train workflow

The compile-and-train workflow uses component label 'compile-and-train'
which wasn't covered by existing network policies. Pods were blocked by
default-deny-all from reaching GitLab SSH (git clone) and HTTP (package
upload/download). Combines compile egress (SSH, external HTTPS, DNS) with
training egress (Tempo OTLP, GitLab HTTP).

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

infra/k8s/argo/argo-workflow-netpol.yaml

@@ -159,6 +159,78 @@ spec:
             matchLabels:
               app.kubernetes.io/name: minio
 ---
+# Compile-and-train workflow pods: compile step needs GitLab SSH + external HTTPS + DNS,
+# training steps need GitLab HTTP (package fetch/upload), MinIO, Tempo, k8s API.
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: argo-compile-and-train-workflow
+  namespace: foxhunt
+  labels:
+    app.kubernetes.io/part-of: foxhunt
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/component: compile-and-train
+  policyTypes:
+    - Egress
+  egress:
+    # DNS
+    - ports:
+        - port: 53
+          protocol: UDP
+        - port: 53
+          protocol: TCP
+    # Kubernetes API — Argo executor
+    - ports:
+        - port: 443
+          protocol: TCP
+        - port: 6443
+          protocol: TCP
+      to:
+        - ipBlock:
+            cidr: 10.32.0.0/16
+        - ipBlock:
+            cidr: 172.16.0.4/32
+    # External HTTPS — cargo fetches crates.io, github.com (candle git dep)
+    - ports:
+        - port: 443
+          protocol: TCP
+    # GitLab SSH — git clone
+    - ports:
+        - port: 2222
+          protocol: TCP
+      to:
+        - ipBlock:
+            cidr: 100.90.76.85/32
+        - podSelector:
+            matchLabels:
+              app: gitlab-shell
+    # GitLab webservice — package upload/download
+    - ports:
+        - port: 8181
+          protocol: TCP
+      to:
+        - podSelector:
+            matchLabels:
+              app: webservice
+    # MinIO — binary upload
+    - ports:
+        - port: 9000
+          protocol: TCP
+      to:
+        - podSelector:
+            matchLabels:
+              app.kubernetes.io/name: minio
+    # Tempo — OTLP traces
+    - ports:
+        - port: 4317
+          protocol: TCP
+      to:
+        - podSelector:
+            matchLabels:
+              app.kubernetes.io/name: tempo
+---
 # CI pipeline pods (detect-changes + compile-service inline templates)
 apiVersion: networking.k8s.io/v1
 kind: NetworkPolicy