fix: delete correct NetworkPolicy name on session cleanup

[angristan]

Summary

• DeleteNetworkRestriction was deleting sess-<id>-network-restrict but ConfigureNetwork creates the policy as sess-<id>-internet-access. This caused internet-access egress policies to leak on every session pause/delete, accumulating orphaned NetworkPolicies over time.

Details

ConfigureNetwork (line 981):

internetPolicyName := fmt.Sprintf("sess-%s-internet-access", sessionID)

DeleteNetworkRestriction (old, line 1146):

restrictPolicyName := fmt.Sprintf("sess-%s-network-restrict", sessionID) // wrong name

The tailnet policy name (sess-%s-tailnet-access) was already correct.

Test plan

• go build ./services/control-plane/...
• go test ./services/control-plane/...
• After deploy, verify orphaned policies are cleaned up on session delete: kubectl --context netclode -n netclode get networkpolicies

[ellie]

I just used this to bootstrap a new machine running on hetzner - nice changes, especially the Codex stuff! If there's anything needed to get it merged, happy to help

[angristan]

@ellie was this meant for #40? 👀

[ellie]

lmao yes it was