fix(netpol): drop the entity-scoped ICMP allow from navidrome (REN-144)

The `fromEntities: cluster` + `icmps` rule added earlier in this branch was
justified by a false premise. Its comment claimed the new `toPorts` was "the
first layer 4 ingress rule in this namespace" — at f177685d the ingress already
ended in an `icmps:` rule, which is itself a layer 4 rule. So the allow was
neither required by this change nor new with it.

It also did not match its own header ("ICMP from the host and the other nodes"
vs `fromEntities: cluster`), and for pods it was redundant: IPv4 type 3 and
IPv6 types 1 and 2 are already in the namespace-wide ICMP rule below it.

ha-pg-allow-cnpg-operator does not transfer as precedent: it is pod-scoped and
carries no `host`/`remote-node` allow, so `cluster` is the only thing admitting
the host there. Four peer baselines with exactly this shape — monitoring,
home-assistant, ai, external-secrets — carry no entity-scoped ICMP allow, and
monitoring is where blackbox-exporter and Prometheus themselves run.

The branch is now exactly the approved REN-28 §4.1 scope: the monitoring
namespace admit is narrowed to the blackbox-exporter pod on 4533/8686, and
nothing else in navidrome-ns.yaml changes.

Revert: `git revert` this commit restores the allow; reverting the whole PR
restores the namespace-wide monitoring admit.

Co-Authored-By: Paperclip <noreply@paperclip.ing>

kubernetes/infrastructure/network-policies/navidrome-ns.yaml

@@ -47,23 +47,6 @@ spec:
     - fromEntities:
         - host
         - remote-node
-    # ICMP from the host and the other nodes. REQUIRED as of REN-28, because
-    # the toPorts above is the first layer 4 ingress rule in this namespace:
-    # Cilium drops ICMP to an endpoint selected by any layer 4 policy unless
-    # the traffic is CT-related, and the rule below matches pods only
-    # (io.kubernetes.pod.namespace Exists), which host and remote-node do not
-    # carry. The kubelet sources the HTTP liveness/readiness probes from the
-    # host netns, so its PMTUD path is host-sourced; without this, Destination
-    # Unreachable / Packet Too Big toward these pods are dropped silently and
-    # the symptom is a stalled transfer, not a policy denial. Same rule and
-    # same reason as ha-pg-allow-cnpg-operator in home-assistant-ns.yaml.
-    - fromEntities:
-        - cluster
-      icmps:
-        - fields:
-            - { type: 3,   family: IPv4 }   # Destination Unreachable — PMTUD
-            - { type: 1,   family: IPv6 }   # Destination Unreachable
-            - { type: 2,   family: IPv6 }   # Packet Too Big — PMTUD, mandatory
     # ICMP — see home-assistant-ns.yaml.
     - fromEndpoints:
         - matchExpressions: