Document or configure the cluster DNS selector used by generated NetworkPolicies #1032

Context

The DNS egress rule baked into every generated NetworkPolicy (#1022, via #75) hardcodes kube-system pods labeled k8s-app: kube-dns. That is correct for kubeadm, k3s/k3d, EKS, and GKE (CoreDNS), but distributions that label their DNS pods differently -- for example OpenShift's dns-default daemonset -- silently break cluster name resolution under the default-deny baseline: every Service lookup times out with no diagnostic pointing at the policy.

Scope

Pick one (or both, docs first):

• Docs: state the supported DNS labeling in docs/kubernetes.md's network-isolation section, so operators on differently labeled distros know the rule needs a passthrough override before anything resolves.
• Configuration: make the DNS selector overridable (e.g. a profile-level spec.security.runtime.networkPolicy.dnsEgress override, or skip-and-replace semantics via the existing per-module passthrough), keeping k8s-app: kube-dns as the default.

Acceptance criteria

• The limitation is documented, or the selector is configurable with the default unchanged.
• A test pins whichever path is chosen.

Estimated effort: 1 hour (docs) / 2-3 hours (configuration)