Wire L1 render conformance tests to the renderer (R-NET-01, R-NET-05/06/07)

Implements the two L1 rendering tests that were failing scaffolds:
- egress-class-render (R-NET-05/06/07): renders vpn + internet fixtures, diffs each
  against a committed golden, asserts the vpn steering label is present on vpn and
  absent on internet (fail-closed), and that flipping the class changes ONLY the
  egress path (R-NET-07). This fixes the --requirements R-NET-05 merge gate.
- default-deny-baseline-render (R-NET-01): asserts every render carries the
  namespaced default-deny baseline, shaped deny-all + both directions.

Each test carries a pure-offline render-check.sh (renderer + golden diff, no
cluster). run.sh runs L1 render checks offline and emits a REAL pass/fail JUnit
(docs/14: L1 rendering assertions run in CI without a cluster) instead of skipping
L1 with the cluster-gated layers; the chainsaw-test.yaml wrappers invoke the same
render-check.sh so an in-cluster run executes the identical assertion.

Co-Authored-By: Claude Opus 4.8 <[email protected]>

conformance/tests/l1-rendering/egress-class-render/chainsaw-test.yaml

@@ -13,9 +13,12 @@
 #       (and `egress: internet` does NOT), and flipping the class only changes the
 #       egress path (R-NET-07), not the workload spec.
 #
-# STATUS: scaffold — needs T-0.3 (renderer contract) + T-3.1/T-3.2 (egress design).
-# Rendering assertions can run without live behavior, but Chainsaw applies to a
-# cluster; until Phase 1 this is skipped by run.sh like every other layer.
+# STATUS: IMPLEMENTED (T-0.3). The render assertion is a pure offline check
+# (render-check.sh: renderer + golden diff, no cluster). conformance/run.sh --layer l1
+# and ci/l1.sh run render-check.sh directly WITHOUT a cluster (docs/14: "L1 rendering
+# assertions run in CI without a cluster"). This Chainsaw Test wraps the SAME
+# render-check.sh in a script step so an in-cluster Chainsaw run executes the identical
+# assertion — rendering the policy, NOT enforcing it (enforcement is proven at L2/L3).
 # =============================================================================
 apiVersion: chainsaw.kyverno.io/v1alpha1
 kind: Test
@@ -33,19 +36,11 @@ metadata:
       egress: vpn renders the egress-gateway + kill-switch path; internet does not.
 spec:
   steps:
-    - name: given-vpn-servicedefinition-render
+    - name: render-and-assert-egress-class
+      description: >-
+        Render the vpn + internet fixtures and assert: each matches its golden; the vpn
+        render carries the egress-class=vpn steering label and internet does not; and the
+        two renders differ ONLY in the egress-class value (R-NET-07).
       try:
         - script:
-            # TODO(T-0.3): invoke the renderer on a fixture ServiceDefinition
-            # (egress: vpn) and capture rendered YAML to $RENDER_OUT.
-            content: 'echo "TODO: render fixtures/svcdef-egress-vpn.yaml -> rendered.yaml"'
-    - name: then-render-contains-killswitched-egress
-      try:
-        - assert:
-            # TODO(T-3.x): assert the rendered set includes the egress-gateway
-            # steering + kill-switch construct for a vpn-class workload.
-            file: golden/egress-vpn.expected.yaml   # TODO: author golden file
-    - name: then-internet-render-omits-vpn-path
-      try:
-        - script:
-            content: 'echo "TODO: render egress: internet fixture; assert NO vpn/gateway steer"'
+            content: bash ./render-check.sh