k8s-netpol-coverage — find the Kubernetes workloads no NetworkPolicy protects

Kubernetes is default-allow: a Pod no NetworkPolicy selects accepts traffic from anywhere. This Go CLI statically audits manifests for uncovered workloads, missing default-deny, and dangling selectors, with table/JSON/SARIF output and a CI gate.