Coder pods initiate OIDC discovery against auth.renner.uno, which
resolves to the ingress-nginx LB. Cilium policy evaluates destination
at the pod endpoint, not the LB VIP, so we need to explicitly allow
egress to the ingress-nginx endpoint. Matches audiobookshelf-ns.yaml.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>