fix(otbr): drop hostNetwork — wrong abstraction for this pod

OTBR's only outbound need is the spinel TCP connection to
slzb-thread.renner.uno:6638. HA and matter-server reach OTBR's REST
API via the ClusterIP Service. None of that requires the host's
network namespace. The wiki's hostnetwork-app-workload-antipattern
applies here.

If border-router coordination on the IoT VLAN ever becomes a real
requirement, the right answer is a Cilium-L2 LoadBalancer pinned IP
(same shape as home-assistant-iot / mosquitto-iot), not hostNetwork.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

kubernetes/apps/otbr/deployment.yaml

@@ -16,11 +16,12 @@ spec:
       labels:
         app.kubernetes.io/name: otbr
     spec:
-      # OTBR needs a real network namespace it can attach the wpan0 Thread
-      # interface to + IPv6 forwarding. hostNetwork on edge keeps it on the
-      # same L2 as the network-attached SLZB Thread RCP.
-      hostNetwork: true
-      dnsPolicy: ClusterFirstWithHostNet
+      # Regular pod network. The only outbound this pod needs is the
+      # spinel TCP connection to slzb-thread.renner.uno:6638; everything
+      # else (HA, matter-server) talks to OTBR via the ClusterIP
+      # Service. If border-router coordination on the IoT VLAN is ever
+      # needed it gets its own Cilium-L2 LoadBalancer IP (analogous to
+      # home-assistant-iot / mosquitto-iot), not hostNetwork.
       nodeSelector:
         topology.kubernetes.io/zone: edge
       tolerations: