fix(web-sentinel): configure apiserver endpoint for manual trigger

scripts/src/hwlab-node-web-sentinel-cicd.ts

@@ -1248,10 +1248,12 @@ function renderSentinelManifests(
 
 function sentinelKubernetesApiEgress(runtime: Record<string, unknown>): readonly Record<string, unknown>[] {
   if (booleanAtNullable(runtime, "kubernetesApi.egress.enabled") !== true) return [];
-  return [{
-    to: [{ ipBlock: { cidr: stringAt(runtime, "kubernetesApi.egress.cidr") } }],
-    ports: [{ protocol: "TCP", port: numberAt(runtime, "kubernetesApi.egress.port") }],
-  }];
+  const rules = arrayAtNullable(runtime, "kubernetesApi.egress.rules");
+  const rows = rules.length > 0 ? rules : [{ cidr: stringAt(runtime, "kubernetesApi.egress.cidr"), port: numberAt(runtime, "kubernetesApi.egress.port") }];
+  return rows.map((rule) => ({
+    to: [{ ipBlock: { cidr: stringAt(rule, "cidr") } }],
+    ports: [{ protocol: "TCP", port: numberAt(rule, "port") }],
+  }));
 }
 
 function sentinelContainerEnv(sentinelId: string, runtime: Record<string, unknown>, cicd: Record<string, unknown>, secrets: Record<string, unknown>): readonly Record<string, unknown>[] {
@@ -4385,6 +4387,11 @@ export function arrayAt(value: unknown, path: string): unknown[] {
   return found;
 }
 
+function arrayAtNullable(value: unknown, path: string): Record<string, unknown>[] {
+  const found = valueAtPath(value, path);
+  return Array.isArray(found) ? found.map(record) : [];
+}
+
 export function recordTarget(value: unknown, label: string): Record<string, unknown> {
   if (!isRecord(value)) throw new Error(`${label} must resolve to an object`);
   return value;