conformance: fix invalid test-level spec.finally for chainsaw v0.2.12

chainsaw v0.2.12 has no test-level `spec.finally` (finally exists only on a
step), and a step-level `finally` accepts only catch-style ops (script/command/
delete/wait), NOT `apply`/`assert`. Both tests failed to parse ("unknown field").

- egress-class: drop the redundant test-level `spec.finally` delete-pods block —
  chainsaw auto-deletes applied fixtures on cleanup (skipDelete: false). The
  valid step-level `finally` that restores the egress-class label is kept.
- vpn-killswitch: move the SAFETY-CRITICAL self-healing tunnel restart out of the
  invalid `spec.finally` and into the STEP-level `finally` of the fault step
  `when-force-tunnel-down-then-no-leak`, implemented as a `script` (finally can't
  use apply/assert) that `kubectl apply`s the privileged node-pinned restart Job
  (name `tunnel-restart`, distinct from `tunnel-stop`) and `kubectl wait`s for it
  to complete — the equivalent of `assert succeeded:1`, blocking teardown until
  the host confirms the tunnel is up. This finally runs even if the no-leak /
  internet-unaffected asserts in the same step's `try` fail, so no path leaves the
  gateway tunnel down. The recovery step is now poll-only (restart already
  happened in the prior step's finally).

Validation with the pinned binary (~/.local/bin/chainsaw v0.2.12):
`chainsaw lint test --file ...` => "The document is valid" for both; `chainsaw
test ... --no-cluster` loads both past the parse stage (no "unknown field"), then
fails only at runtime for lack of a cluster (expected). yamllint + run.sh
--strict-coverage clean (RC=0). No live apply / fault injection, no spec edits.

Co-Authored-By: Claude Opus 4.8 <[email protected]>

conformance/tests/l2-behavioral/egress-class/chainsaw-test.yaml

@@ -158,13 +158,6 @@ spec:
                 homelab.keithjackson.dev/egress-class=vpn --overwrite
               echo "restored egress-class=vpn"
     # ---------------------------------------------------------------------------
-  # Fixtures are deleted by Chainsaw's per-test namespace teardown; this explicit
-  # finally is belt-and-suspenders so a leaked pod is impossible even if the ns
-  # deletion is ever disabled.
-  finally:
-    - delete:
-        ref:
-          apiVersion: v1
-          kind: Pod
-        labels:
-          app: egress-test
+    # Fixtures are torn down automatically by Chainsaw's per-test namespace deletion
+    # (config/chainsaw-config.yaml sets skipDelete: false), so no explicit fixture
+    # cleanup step is needed — and chainsaw v0.2.12 has no test-level spec.finally.