Wire L1 render conformance tests to the renderer (R-NET-01, R-NET-05/06/07)

Implements the two L1 rendering tests that were failing scaffolds:
- egress-class-render (R-NET-05/06/07): renders vpn + internet fixtures, diffs each
  against a committed golden, asserts the vpn steering label is present on vpn and
  absent on internet (fail-closed), and that flipping the class changes ONLY the
  egress path (R-NET-07). This fixes the --requirements R-NET-05 merge gate.
- default-deny-baseline-render (R-NET-01): asserts every render carries the
  namespaced default-deny baseline, shaped deny-all + both directions.

Each test carries a pure-offline render-check.sh (renderer + golden diff, no
cluster). run.sh runs L1 render checks offline and emits a REAL pass/fail JUnit
(docs/14: L1 rendering assertions run in CI without a cluster) instead of skipping
L1 with the cluster-gated layers; the chainsaw-test.yaml wrappers invoke the same
render-check.sh so an in-cluster run executes the identical assertion.

Co-Authored-By: Claude Opus 4.8 <[email protected]>

conformance/tests/l1-rendering/default-deny-baseline-render/chainsaw-test.yaml

@@ -11,7 +11,11 @@
 # the L0 Kyverno gate (T-0.5). Rendering the baseline is necessary but NOT
 # sufficient — enforcement is proven behaviorally at L2 (R-TEST-01).
 #
-# STATUS: scaffold — needs T-0.3 (renderer) + T-2.2 (baseline definition).
+# STATUS: IMPLEMENTED (T-0.3). render-check.sh renders a service and asserts the
+# namespaced default-deny baseline is present + shaped (deny-all, both directions) —
+# a pure offline check (renderer + golden diff, no cluster). conformance/run.sh --layer
+# l1 and ci/l1.sh run it directly; this Chainsaw Test wraps the SAME script so an
+# in-cluster run executes the identical assertion. Rendering != enforcement (proven L2).
 # =============================================================================
 apiVersion: chainsaw.kyverno.io/v1alpha1
 kind: Test
@@ -27,11 +31,10 @@ metadata:
       Rendering any service's namespace yields a default-deny baseline policy.
 spec:
   steps:
-    - name: given-a-rendered-namespace
+    - name: render-and-assert-default-deny
+      description: >-
+        Render a service and assert the namespaced default-deny baseline is present and
+        shaped (deny-all ingress, both Ingress+Egress), matching the golden.
       try:
         - script:
-            content: 'echo "TODO(T-0.3/T-2.2): render a service; capture namespaced policies"'
-    - name: then-render-includes-default-deny
-      try:
-        - assert:
-            file: golden/default-deny-baseline.expected.yaml   # TODO: author golden
+            content: bash ./render-check.sh