ingress-nginx: the admission webhook CiliumNetworkPolicy breaks ingress on clusters without Cilium (isp-hosted) #4706

packages/system/ingress-nginx/templates/admission-webhook-networkpolicy.yaml renders a cilium.io/v2 CiliumNetworkPolicy, guarded only by admissionWebhookPolicy.enabled (default true). The ingress application is unconditional in the system bundle, and isp-hosted runs on a host CNI without Cilium CRDs. So on isp-hosted, any tenant with ingress: true fails its ingress-nginx install with no matches for kind "CiliumNetworkPolicy", the same failure #3387 fixes for the tenant chart. Found while fixing #3387; the isp-hosted lane (#3390) will hit it as soon as a tenant enables ingress. Fix shape: render the policy only where Cilium is guaranteed, using the same variant key and capability check the #3387 fix uses, and decide explicitly what protects the webhook on a non-Cilium cluster (the policy exists because of CVE-2025-1974). The security consequence should be written in the PR, not dropped silently.