A Cilium FQDN policy allows image pulls and blocks a later gRPC dependency

Bootstrap traffic works, yet the later workload uses a different DNS path that yields IPs outside the policy's learned set.