mecak8s: isolate the unauthenticated drain endpoint from workload traffic

Problem

mecak8s binds an unauthenticated drain listener to 0.0.0.0:8082. GET /drain irreversibly marks the process draining and unready, but the chart creates no NetworkPolicy selecting the agent pods. Any workload with direct Pod-IP reachability can therefore remove replicas from service.

Issue #656 deliberately separated /drain from the client HTTP API, but direct pod-network access remains an operator obligation rather than a chart-enforced boundary.

Evidence

• deploy/helm/mecak8s/templates/deployment.yaml: --drain-addr=0.0.0.0:8082, the drain container port, and the preStop HTTP hook.
• cmd/mecak8s/serve.go: drainHTTPMux calls svc.Drain() before returning 200.
• deploy/helm/mecak8s/templates/raw-driver-networkpolicy.yaml does not select agent pods.

Proposed direction

Provide a default or explicitly enabled ingress-isolation policy that allows normal API/probe traffic while preventing workload access to port 8082, and test it with the supported CNI/kubelet lifecycle behavior. If a portable policy cannot guarantee kubelet access, redesign the lifecycle mechanism or fail closed with a prominently validated operator contract.

Acceptance criteria

• Untrusted pods cannot invoke an agent pod's drain endpoint.
• The kubelet preStop hook continues to work on supported Kubernetes/CNI configurations.
• Normal gRPC, HTTP, readiness, and liveness traffic remains functional.
• The Kind/e2e suite proves both allowed and denied paths.

Start with deploy/helm/mecak8s/templates/deployment.yaml and raw-driver-networkpolicy.yaml, then inspect cmd/mecak8s/serve.go to understand the drain listener and preStop hook. Run the Kind/e2e suite and trace supported CNI and kubelet behavior. Done means workload access to port 8082 is denied while kubelet lifecycle calls and normal gRPC, HTTP, readiness, and liveness traffic continue to work.