Wire L1 render conformance tests to the renderer (R-NET-01, R-NET-05/06/07)

Implements the two L1 rendering tests that were failing scaffolds:
- egress-class-render (R-NET-05/06/07): renders vpn + internet fixtures, diffs each
  against a committed golden, asserts the vpn steering label is present on vpn and
  absent on internet (fail-closed), and that flipping the class changes ONLY the
  egress path (R-NET-07). This fixes the --requirements R-NET-05 merge gate.
- default-deny-baseline-render (R-NET-01): asserts every render carries the
  namespaced default-deny baseline, shaped deny-all + both directions.

Each test carries a pure-offline render-check.sh (renderer + golden diff, no
cluster). run.sh runs L1 render checks offline and emits a REAL pass/fail JUnit
(docs/14: L1 rendering assertions run in CI without a cluster) instead of skipping
L1 with the cluster-gated layers; the chainsaw-test.yaml wrappers invoke the same
render-check.sh so an in-cluster run executes the identical assertion.

Co-Authored-By: Claude Opus 4.8 <[email protected]>

conformance/run.sh

@@ -169,6 +169,28 @@ run_chainsaw() {
   fi
 }
 
+# --- L1 rendering: cluster-INDEPENDENT render checks (docs/14) --------------------------
+# L1 verifies ServiceDefinition -> rendered-resources against golden expectations; it needs
+# no live cluster. Each l1-rendering test dir carries a `render-check.sh` (renderer + golden
+# diff + structural asserts). We run those directly and emit a REAL pass/fail JUnit, instead
+# of skipping L1 with the cluster-gated layers (T-0.3). Honors the same --layer/--requirements
+# selection as the rest of the suite (select_dirs), filtered to the l1-rendering subtree.
+l1_selected_dirs() {
+  select_dirs | grep '/l1-rendering/' || true
+}
+
+run_l1_offline() {
+  local -a l1dirs
+  mapfile -t l1dirs < <(l1_selected_dirs)
+  if [ "${#l1dirs[@]}" -eq 0 ]; then
+    log "No L1 render tests match the selection (layer=${LAYER} reqs='${REQS}')."
+    return 0
+  fi
+  log "Running ${#l1dirs[@]} L1 render check(s) OFFLINE (no cluster; docs/14)."
+  "${PYTHON}" "${CONF_ROOT}/lib/run_l1_offline.py" \
+    --junit "${JUNIT_OUT}" --label-prefix "${CONF_LABEL_PREFIX}" "${l1dirs[@]}"
+}
+
 ###############################################################################
 # Main
 ###############################################################################
@@ -187,9 +209,29 @@ case "${MODE}" in
     ;;
 esac
 
-# run mode: need a cluster for L1/L2/L3. Without one (Phase 0), emit skipped JUnit.
+# L1 rendering is cluster-independent (docs/14): run the selected L1 render checks offline
+# and treat their result as authoritative REGARDLESS of cluster availability. A render-check
+# failure is a real failure (nothing cluster-gated about it), so it always blocks.
+L1_RC=0
+run_l1_offline || L1_RC=$?
+if [ "${LAYER}" = l1 ]; then
+  # L1-only run (the ci/l1.sh merge-gate path): the offline render result IS the result.
+  if [ "${L1_RC}" -eq 0 ]; then
+    log "Done (L1 render). JUnit: ${JUNIT_OUT} | Coverage: ${COVERAGE_OUT}/coverage.md"
+  else
+    log "L1 render checks FAILED (rc=${L1_RC}). JUnit: ${JUNIT_OUT}"
+  fi
+  exit "${L1_RC}"
+fi
+if [ "${L1_RC}" -ne 0 ]; then
+  log "L1 render checks FAILED (rc=${L1_RC}) — blocking (render failure is not cluster-gated)."
+  exit "${L1_RC}"
+fi
+
+# run mode: need a cluster for L2/L3. Without one (Phase 0), emit skipped JUnit for the
+# cluster-gated layers. (L1 already ran offline above and passed.)
 if [ "${FORCE_NO_CLUSTER}" = 1 ] || ! conf_cluster_reachable; then
-  log "No reachable cluster — emitting SKIPPED JUnit scaffold (Phase 0 behavior)."
+  log "No reachable cluster — emitting SKIPPED JUnit scaffold for L2/L3 (Phase 0 behavior)."
   log "Also running structural lint so scaffolds stay valid."
   lint_tests || { log "lint failed"; exit 1; }
   "${PYTHON}" "${CONF_ROOT}/lib/emit_skipped_junit.py" \