An application team runs a Pod named 'reporter' in the 'analytics' namespace. Business requirements state the Pod must be allowed to send traffic to any destination in the 10.0.0.0/8 range EXCEPT the sensitive management subnet 10.0.5.0/24. You must write a single NetworkPolicy applied to 'reporter' to enforce this egress restriction. Which egress rule configuration achieves this correctly?