Review: NetworkPolicy drift -- add woodpecker to keycloak/postgres allow lists (re-review)

Verdict: READY

Previous Issues -- Resolution

• [x] [LABEL] story label -- Changed from story:ci-cd-pipeline to story:superuser-deploy. Verified: board item now carries story:superuser-deploy, which matches the project-pal-e-platform user-stories entry ("I can deploy infrastructure changes via tofu plan/apply and see them succeed in Woodpecker CI without manual intervention").
• [x] [SCOPE] arch note -- Architecture note arch-network-policy created (pal-e-docs id 2082). Covers overview, key resources (netpol_keycloak, netpol_postgres, netpol_harbor, netpol_minio), conventions, and links to SOP and Phase 8.

Template Completeness

• [x] Type -- Bug
• [x] Lineage -- "Discovered while setting up pal-e-services CI pipeline (pal-e-services#127)"
• [x] Repo -- ldraney/pal-e-platform
• [x] What Broke -- detailed description with error messages (connection refused, connection timed out)
• [x] Repro Steps -- 3 clear steps
• [x] Expected Behavior -- clear: both should allow ingress from woodpecker namespace
• [x] Environment -- "k3s cluster, Woodpecker 3.13.0"
• [x] Acceptance Criteria -- 2 items, both actionable
• [x] Related -- mentions manual patches as workaround

Traceability

• [x] story:superuser-deploy label -- verified in project-pal-e-platform user-stories section
• [x] arch:network-policy label -- present on board item
• [x] arch note verified -- arch-network-policy note exists in pal-e-docs (id 2082)
• [x] Forgejo issue -- ldraney/pal-e-platform#456, state: open

File Targets

• [x] terraform/network-policies.tf -- verified exists at /home/ldraney/pal-e-platform/terraform/network-policies.tf
• [x] netpol_keycloak (lines 135-159) -- confirmed: allows tailscale, basketball-api, westside-ai-assistant, pal-enterprises, landscaping-assistant, monitoring. Missing woodpecker.
• [x] netpol_postgres (lines 161-190) -- confirmed: allows pal-e-app, basketball-api, pal-enterprises, cnpg-system, monitoring, westside-ror, pal-e-docs, pal-e-ror, landscaping-assistant, palinks, paldocs. Missing woodpecker.
• [x] netpol_harbor -- confirmed: already includes woodpecker at line 99. Issue claim verified.

Repo Placement

Dependencies

• Item #1150 (backlog) -- "[POST-INCIDENT] postgres NP missing pal-e-docs after #287 rename" -- same arch:network-policy pattern, historical precedent.
• Item #1480 (backlog) -- "Woodpecker CI: tofu plan on PR, apply on merge (platform)" -- downstream feature unblocked by this fix.
• Item #1481 (backlog) -- "Woodpecker CI: tofu plan on PR, apply on merge (services)" -- also unblocked by this fix per Lineage (pal-e-services#127).

Acceptance Criteria

• AC1: grep terraform/network-policies.tf for woodpecker in netpol_keycloak block -- pass/fail
• AC2: grep terraform/network-policies.tf for woodpecker in netpol_postgres block -- pass/fail

Blast Radius

Decomposition Assessment

Recommendation