Wire L1 render conformance tests to the renderer (R-NET-01, R-NET-05/06/07)

Implements the two L1 rendering tests that were failing scaffolds:
- egress-class-render (R-NET-05/06/07): renders vpn + internet fixtures, diffs each
  against a committed golden, asserts the vpn steering label is present on vpn and
  absent on internet (fail-closed), and that flipping the class changes ONLY the
  egress path (R-NET-07). This fixes the --requirements R-NET-05 merge gate.
- default-deny-baseline-render (R-NET-01): asserts every render carries the
  namespaced default-deny baseline, shaped deny-all + both directions.

Each test carries a pure-offline render-check.sh (renderer + golden diff, no
cluster). run.sh runs L1 render checks offline and emits a REAL pass/fail JUnit
(docs/14: L1 rendering assertions run in CI without a cluster) instead of skipping
L1 with the cluster-gated layers; the chainsaw-test.yaml wrappers invoke the same
render-check.sh so an in-cluster run executes the identical assertion.

Co-Authored-By: Claude Opus 4.8 <[email protected]>

conformance/tests/l1-rendering/default-deny-baseline-render/fixtures/svcdef.yaml

@@ -0,0 +1,8 @@
+# L1 fixture: a minimal ServiceDefinition. Any onboarded service — regardless of its
+# dependencies — must render the namespaced default-deny baseline (R-NET-01). This fixture
+# declares NO dependencies, so its render must still carry the deny-all + DNS-only baseline.
+# Validates against schemas/servicedefinition.schema.json.
+name: baseline-demo
+kind: container
+source:
+  image: nginx:1.27