I'm testing NanoClaw in a home lab setup, following the hardening guide. I created a basic network policy with a default deny all egress rule, then added explicit allow rules for known dependencies.

But my agent's traffic to the home assistant API is still getting blocked. I can see the connection attempts failing in the logs. My allow rule looks correct to me. Here's the relevant part of my policy spec:

```
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: allow-agent-to-home-assistant
spec:
podSelector:
matchLabels:
app: nanoclaw-agent
policyTypes:
- Egress
egress:
- to:
- ipBlock:
cidr: 192.168.1.0/24
ports:
- protocol: TCP
port: 8123
```

The agent pod has the label `app: nanoclaw-agent`. The home assistant instance is at 192.168.1.50:8123 on that subnet. Am I missing a rule for DNS? Or is the `ipBlock` selector not the right way to point to a specific service outside the cluster?