Turns a node/edge agent graph into real Kubernetes NetworkPolicy microsegmentation, scoped to a dedicated cain-swarms namespace via a restricted ServiceAccount that cannot touch any other namespace or resource kind.
This service has no operations beyond health checks right now.