Comms: announce default-deny network policies as the new default

[weatherhog]

Part of #4338.

• Changes/highlights post
• Customer announcement via AEs/Slack ahead of the default flip (existing clusters unaffected; new clusters get default-deny in all namespaces)
• Handbook/intranet entry for support: exception workflow, common day-one breakages (apiserver egress, webhook ingress, Flux traffic), FAQ/runbook