fix(conformance): block-style chainsaw checks (flow-map broke on contains comma)

My previous commit converted =~ to contains() but kept flow style
'check: { (contains($stdout, 'X')): true }' — the comma inside contains() is a
YAML flow-map separator, so 9 tests failed yamllint ('expected , or }'). Convert
those checks to block style (matching data-survival), where a comma in the key
scalar is fine. Gate PASS; data-survival still green.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

conformance/tests/l2-behavioral/egress-class/chainsaw-test.yaml

@@ -38,7 +38,8 @@ spec:
                      curl -fsS https://api.ipify.org)
               echo "internet_ip=$ip"
               # TODO: assert ip is in home/WAN set, not the PIA range.
-            check: { (contains($stdout, 'internet_ip=')): true }
+            check:
+              (contains($stdout, 'internet_ip=')): true
     - name: then-vpn-shows-vpn-ip
       try:
         - script:
@@ -48,7 +49,8 @@ spec:
                      curl -fsS https://api.ipify.org)
               echo "vpn_ip=$ip"
               # TODO: assert ip is a PIA egress address (distinct from WAN IP).
-            check: { (contains($stdout, 'vpn_ip=')): true }
+            check:
+              (contains($stdout, 'vpn_ip=')): true
     - name: when-flip-egress-class-in-git
       try:
         - script:

conformance/tests/l2-behavioral/sso-forward-auth/chainsaw-test.yaml

@@ -37,7 +37,8 @@ spec:
                 curl -s -o /dev/null -w '%{http_code}' https://<service>.home.keithjackson.dev)
               echo "unauth_code=$code"
               case "$code" in 302|303|401|403) echo CHALLENGED_OK ;; *) exit 1 ;; esac
-            check: { (contains($stdout, 'CHALLENGED_OK')): true }
+            check:
+              (contains($stdout, 'CHALLENGED_OK')): true
     - name: then-authenticated-is-granted
       try:
         - script: