A NetworkPolicy allows the outbound proxy but still blocks OCSP and CRL endpoints, so strict clients fail external TLS validation

Egress seems mostly open, yet revocation checks cannot complete because only the primary proxy path was modeled.