Egress NetworkPolicy part-of label mismatch leaves most pods unsealed

[shreyanshjain7174]

Problem

The default-deny egress NetworkPolicy selects pods by app.kubernetes.io/part-of: agentic-operator (charts/templates/networkpolicy.yaml:36). But the rest of the platform stamps pods with agentic-k8s-operator:

• pkg/argo/workflow.go (Argo workflow pods)
• config/argo/*
• config/shared-services/*
• config/rbac/argo_role.yaml

So the egress seal matches almost nothing today, including Argo-managed pods. This undermines the zero-egress governance claim for the argo runtime.

Context

Surfaced during review of #167 (kagent runtime adapter). The new pkg/runtime.governanceLabels helper deliberately uses the NetworkPolicy's value (agentic-operator), so pod and kagent runtime pods ARE sealed correctly. The gap is the older argo/shared-services path.

Fix

Pick one canonical value for app.kubernetes.io/part-of and reconcile it everywhere:

1. Decide canonical value (agentic-operator matches the policy; changing the policy to agentic-k8s-operator matches everything else).
2. Update all producers and the NetworkPolicy selector to agree.
3. Add a test that asserts every runtime's pods carry the label the policy selects.

Scoped as its own PR since it touches Argo, shared services, and RBAC.