An egress-deny policy passes init checks and later leaks telemetry

Bootstrap validation is green, but the steady-state dataplane uses a different path than the policy test covered.