fix(conformance): block-style chainsaw checks (flow-map broke on contains comma)

My previous commit converted =~ to contains() but kept flow style
'check: { (contains($stdout, 'X')): true }' — the comma inside contains() is a
YAML flow-map separator, so 9 tests failed yamllint ('expected , or }'). Convert
those checks to block style (matching data-survival), where a comma in the key
scalar is fine. Gate PASS; data-survival still green.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

conformance/tests/l2-behavioral/egress-class/chainsaw-test.yaml

@@ -38,7 +38,8 @@ spec:
                      curl -fsS https://api.ipify.org)
               echo "internet_ip=$ip"
               # TODO: assert ip is in home/WAN set, not the PIA range.
-            check: { (contains($stdout, 'internet_ip=')): true }
+            check:
+              (contains($stdout, 'internet_ip=')): true
     - name: then-vpn-shows-vpn-ip
       try:
         - script:
@@ -48,7 +49,8 @@ spec:
                      curl -fsS https://api.ipify.org)
               echo "vpn_ip=$ip"
               # TODO: assert ip is a PIA egress address (distinct from WAN IP).
-            check: { (contains($stdout, 'vpn_ip=')): true }
+            check:
+              (contains($stdout, 'vpn_ip=')): true
     - name: when-flip-egress-class-in-git
       try:
         - script:

conformance/tests/l2-behavioral/sso-forward-auth/chainsaw-test.yaml

@@ -37,7 +37,8 @@ spec:
                 curl -s -o /dev/null -w '%{http_code}' https://<service>.home.keithjackson.dev)
               echo "unauth_code=$code"
               case "$code" in 302|303|401|403) echo CHALLENGED_OK ;; *) exit 1 ;; esac
-            check: { (contains($stdout, 'CHALLENGED_OK')): true }
+            check:
+              (contains($stdout, 'CHALLENGED_OK')): true
     - name: then-authenticated-is-granted
       try:
         - script:

conformance/tests/l3-fault-injection/alerting/chainsaw-test.yaml

@@ -48,7 +48,8 @@ spec:
               set -euo pipefail
               echo "TODO: query smtp-sink for an email whose subject matches the alert"
               echo "EMAIL_DELIVERED_OK"
-            check: { (contains($stdout, 'EMAIL_DELIVERED_OK')): true }
+            check:
+              (contains($stdout, 'EMAIL_DELIVERED_OK')): true
       finally:
         - script:
             content: 'echo "TODO: clear the injected fault + drain the sink (self-cleaning)"'

conformance/tests/l3-fault-injection/default-deny-failclosed/chainsaw-test.yaml

@@ -40,7 +40,8 @@ spec:
             content: |
               set -euo pipefail
               kubectl -n "$NAMESPACE" exec source -- nc -z -w 3 dest 80 && echo ALLOWED_OK
-            check: { (contains($stdout, 'ALLOWED_OK')): true }
+            check:
+              (contains($stdout, 'ALLOWED_OK')): true
     - name: when-revoke-allow-then-fail-closed
       try:
         # FAULT INJECTION: delete the allow policy; baseline default-deny remains.
@@ -56,13 +57,15 @@ spec:
                 echo "LEAK: still reachable after allow revoked" >&2; exit 1
               fi
               echo FAIL_CLOSED_OK
-            check: { (contains($stdout, 'FAIL_CLOSED_OK')): true }
+            check:
+              (contains($stdout, 'FAIL_CLOSED_OK')): true
         - script:
             # DNS must still work (default-deny permits DNS egress).
             content: |
               set -euo pipefail
               kubectl -n "$NAMESPACE" exec source -- nslookup kubernetes.default && echo DNS_OK
-            check: { (contains($stdout, 'DNS_OK')): true }
+            check:
+              (contains($stdout, 'DNS_OK')): true
       finally:
         - script:
             content: 'echo "cleanup via chainsaw namespace teardown"'

conformance/tests/l3-fault-injection/dr-restore/chainsaw-test.yaml

@@ -46,7 +46,8 @@ spec:
               set -euo pipefail
               echo "TODO: assert app Ready in restored ns AND canary data present"
               echo "DR_RESTORE_OK"
-            check: { (contains($stdout, 'DR_RESTORE_OK')): true }
+            check:
+              (contains($stdout, 'DR_RESTORE_OK')): true
       finally:
         - script:
             content: 'echo "TODO: delete the restore target namespace (self-cleaning)"'

conformance/tests/l3-fault-injection/gitops-drift/chainsaw-test.yaml

@@ -45,7 +45,8 @@ spec:
               set -euo pipefail
               echo "TODO: within Flux interval, assert live value == git-declared value"
               echo "DRIFT_REVERTED_OK"
-            check: { (contains($stdout, 'DRIFT_REVERTED_OK')): true }
+            check:
+              (contains($stdout, 'DRIFT_REVERTED_OK')): true
       finally:
         - script:
             content: 'echo "TODO: ensure resource left in git-declared state"'

conformance/tests/l3-fault-injection/hands-off-update/chainsaw-test.yaml

@@ -56,7 +56,8 @@ spec:
               echo "TODO: assert rolled back to last-good revision"
               echo "TODO: assert Alertmanager delivered an email alert (see alerting test)"
               echo "ROLLBACK_OK"
-            check: { (contains($stdout, 'ROLLBACK_OK')): true }
+            check:
+              (contains($stdout, 'ROLLBACK_OK')): true
       finally:
         - script:
             content: 'echo "TODO: reset automation to a good tag (self-cleaning)"'

conformance/tests/l3-fault-injection/vpn-killswitch/chainsaw-test.yaml

@@ -51,14 +51,16 @@ spec:
                 echo "LEAK: vpn workload reached internet with tunnel down" >&2; exit 1
               fi
               echo NO_LEAK_OK
-            check: { (contains($stdout, 'NO_LEAK_OK')): true }
+            check:
+              (contains($stdout, 'NO_LEAK_OK')): true
         - script:
             # AND: internet-class workload is unaffected.
             content: |
               set -euo pipefail
               kubectl -n "$NAMESPACE" exec egress-internet -- \
                 curl -fsS --max-time 5 https://api.ipify.org && echo INTERNET_UNAFFECTED_OK
-            check: { (contains($stdout, 'INTERNET_UNAFFECTED_OK')): true }
+            check:
+              (contains($stdout, 'INTERNET_UNAFFECTED_OK')): true
     - name: when-tunnel-recovers-connectivity-returns
       try:
         - script:

conformance/tests/meta/harness-selfcheck/chainsaw-test.yaml

@@ -50,7 +50,8 @@ spec:
               test -f _artifacts/coverage/coverage.md
               test -f _artifacts/coverage/coverage.json
               echo COVERAGE_EMITTED_OK
-            check: { (contains($stdout, 'COVERAGE_EMITTED_OK')): true }
+            check:
+              (contains($stdout, 'COVERAGE_EMITTED_OK')): true
     - name: r-test-02-reproducible
       try:
         - script:
@@ -63,7 +64,8 @@ spec:
               ./run.sh --coverage-only >/dev/null
               b=$(sha256sum _artifacts/coverage/coverage.json | awk '{print $1}')
               [ "$a" = "$b" ] && echo REPRODUCIBLE_OK
-            check: { (contains($stdout, 'REPRODUCIBLE_OK')): true }
+            check:
+              (contains($stdout, 'REPRODUCIBLE_OK')): true
     - name: r-test-01-04-every-test-is-tagged
       try:
         - script:
@@ -79,7 +81,8 @@ spec:
               assert rep["summary"]["annotation_label_mismatches"]==0, "label/annotation drift"
               print("ALL_TAGGED_OK")
               PY
-            check: { (contains($stdout, 'ALL_TAGGED_OK')): true }
+            check:
+              (contains($stdout, 'ALL_TAGGED_OK')): true
     - name: r-test-05-no-safety-critical-gaps
       try:
         - script:
@@ -96,4 +99,5 @@ spec:
               assert not gaps, f"safety-critical gaps without L3 test: {gaps}"
               print("NO_SAFETY_GAPS_OK")
               PY
-            check: { (contains($stdout, 'NO_SAFETY_GAPS_OK')): true }
+            check:
+              (contains($stdout, 'NO_SAFETY_GAPS_OK')): true