Wire L1 render conformance tests to the renderer (R-NET-01, R-NET-05/06/07)

Implements the two L1 rendering tests that were failing scaffolds:
- egress-class-render (R-NET-05/06/07): renders vpn + internet fixtures, diffs each
  against a committed golden, asserts the vpn steering label is present on vpn and
  absent on internet (fail-closed), and that flipping the class changes ONLY the
  egress path (R-NET-07). This fixes the --requirements R-NET-05 merge gate.
- default-deny-baseline-render (R-NET-01): asserts every render carries the
  namespaced default-deny baseline, shaped deny-all + both directions.

Each test carries a pure-offline render-check.sh (renderer + golden diff, no
cluster). run.sh runs L1 render checks offline and emits a REAL pass/fail JUnit
(docs/14: L1 rendering assertions run in CI without a cluster) instead of skipping
L1 with the cluster-gated layers; the chainsaw-test.yaml wrappers invoke the same
render-check.sh so an in-cluster run executes the identical assertion.

Co-Authored-By: Claude Opus 4.8 <[email protected]>

conformance/tests/l1-rendering/egress-class-render/fixtures/svcdef-egress-internet.yaml

@@ -0,0 +1,30 @@
+# L1 fixture: an internet-class ServiceDefinition. BYTE-IDENTICAL to svcdef-egress-vpn.yaml
+# EXCEPT `egress: internet`. The two renders must differ ONLY in the egress path (R-NET-07):
+# the internet render carries NO vpn steering label. Validates against the schema.
+name: sonarr
+kind: container
+source:
+  image: linuxserver/sonarr
+exposure: internal
+egress: internet
+storage:
+  - name: config
+    size: 2Gi
+    class: longhorn
+ingressRoutes:
+  - host: sonarr.home.keithjackson.dev
+    port: 8989
+auth:
+  mode: forward-auth
+  groups:
+    - media-admins
+update:
+  channel: stable
+  cadence: "0 4 * * *"
+  autoRollbackOnFailedHealth: true
+observability:
+  metrics: true
+  slis:
+    - up
+backup:
+  policy: daily-offcluster

conformance/tests/l1-rendering/egress-class-render/fixtures/svcdef-egress-vpn.yaml

@@ -0,0 +1,31 @@
+# L1 fixture: a vpn-class ServiceDefinition. Identical to svcdef-egress-internet.yaml
+# EXCEPT `egress: vpn`, so the render diff isolates the egress path (R-NET-05/07).
+# sonarr is in the normative vpn-class set (docs/03/13). Validates against
+# schemas/servicedefinition.schema.json.
+name: sonarr
+kind: container
+source:
+  image: linuxserver/sonarr
+exposure: internal
+egress: vpn
+storage:
+  - name: config
+    size: 2Gi
+    class: longhorn
+ingressRoutes:
+  - host: sonarr.home.keithjackson.dev
+    port: 8989
+auth:
+  mode: forward-auth
+  groups:
+    - media-admins
+update:
+  channel: stable
+  cadence: "0 4 * * *"
+  autoRollbackOnFailedHealth: true
+observability:
+  metrics: true
+  slis:
+    - up
+backup:
+  policy: daily-offcluster