A service mesh sidecar is injected correctly and egress still fails

Pods look normal, yet external calls die because the actual DNS and egress path the node uses no longer matches the mesh policy model.