cks: swap kind CNI to Cilium, fix broken ingress-nginx setup

kindnet's NetworkPolicy enforcement isn't guaranteed, undermining the
Task 1 lab; Cilium (with kube-proxy replacement) enforces it
deterministically. Also fixes ingress-nginx, which was silently broken:
missing ingress-ready node label left the controller Pending forever,
and hostPorts 80/443 were never mapped in kind-config.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

kubernetes/cks/exam-by-claude/solutions.md

@@ -34,7 +34,11 @@ Verify:
 kubectl -n prod exec deploy/frontend -- curl -s --max-time 3 db:5432   # -> db-ok
 kubectl -n prod exec deploy/attacker -- curl -s --max-time 3 db:5432   # -> timeout
 ```
-Gotcha: kind's default CNI (kindnetd) enforces NetworkPolicy in recent versions; if your kindnet build doesn't, swap to Calico. On the exam CNI always enforces.
+Gotcha: this cluster runs Cilium (not kindnetd), which enforces NetworkPolicy deterministically — no "if your build doesn't enforce it" caveat. If the attacker curl doesn't actually time out, don't blame the CNI; debug it:
+```bash
+cilium status                                              # agents healthy on all 3 nodes?
+kubectl -n kube-system exec ds/cilium -- cilium-dbg endpoint list   # policy enforcement column for the db/attacker/frontend endpoints
+```
 
 ---
 
@@ -64,9 +68,8 @@ spec:
             pathType: Prefix
             backend: {service: {name: hello, port: {number: 80}}}
 ```
-Verify (port depends on how ingress-nginx is exposed in kind — NodePort or the hostPort mapping):
+Verify:
 ```bash
-kubectl -n ingress-nginx get svc ingress-nginx-controller
 curl -k --resolve hello.cks.local:443:127.0.0.1 https://hello.cks.local/
 ```