An egress-deny policy passes init checks and later leaks telemetry

Bootstrap validation is green, yet the steady-state traffic uses a different path than the one the policy was tested against.