conformance: serialize heavy L2/L3 tests + author alerting SMTP sink

TASK 1 — reliably single-pass green L2/L3:
Split run_chainsaw into a LIGHT pass (concurrent, config parallelism) and a
HEAVY pass (serial, parallel=1). The KubeVirt-CDI/Longhorn/DR tests
(vm-lifecycle, vm-data-survival, vm-default-deny, data-survival, dr-restore)
spike embedded-etcd on the small dev VMs; running them serially in their own
pass keeps their etcd spikes from ever coinciding with another test's setup —
the coincidence that let one heavy test's apiserver blip fail-close Kyverno
admission and abort every in-flight test at 0.01s. Heavy set is keyed by test
dir basename and overridable via CONF_HEAVY_TESTS. Each pass writes its own
JUnit; lib/merge_junit.py stitches them into the one stable report.junit.xml
CI collects, so the split is invisible downstream. Overall rc is the union of
both passes (no masking — real failures still surface).

Proof: full --layer l2,l3 run now completes single-pass green: 24/24 passed,
0 failures/errors/skipped. vpn-killswitch, which previously failed with an
apiserver EOF (etcd blip), passed; no mass environmental setup-aborts.

TASK 2 (T-4.1) — author conformance/tests/l3-fault-injection/alerting/
fixtures/smtp-sink.yaml: a hermetic Mailpit SMTP capture sink (Service
smtp-sink, SMTP 1025, HTTP API 8025) the alerting test applies as its mail
sink. restricted-PodSecurity compliant, in-memory (no PVC). Unblocks the
previously-aborting alerting scaffold; it now passes.

Touches conformance/ + ci-read content only — no apps/ or platform/ workload.

Co-Authored-By: Claude Opus 4.8 <[email protected]>

conformance/tests/l3-fault-injection/alerting/fixtures/smtp-sink.yaml

@@ -0,0 +1,121 @@
+# =============================================================================
+# T-4.1 — Hermetic SMTP capture sink for the L3 "alerting" conformance test
+# (R-OBS-02, R-OBS-04).
+#
+# The alerting test injects a fault, Alertmanager fires and routes an email, and
+# the test asserts the email arrived. To keep the test hermetic (no real inbox,
+# ADR-0011 reproducibility), Alertmanager's email route is pointed at THIS
+# in-namespace sink instead of a real MTA. The sink is Mailpit: it speaks SMTP
+# for delivery and exposes an HTTP API the test polls for the captured message.
+#
+# Contract the alerting test relies on (chainsaw injects the ephemeral namespace,
+# so these are intentionally namespace-less):
+#   * Service name .............. smtp-sink        (stable DNS the test/AM target)
+#   * SMTP port (delivery) ...... 1025             (Alertmanager `smarthost`)
+#   * HTTP port (query/API) ..... 8025             (test polls for the message)
+#   * Query endpoint ............ GET http://smtp-sink:8025/api/v1/messages
+#                                 -> JSON: .messages[].Subject / .To / .From
+#     (health: GET /api/v1/messages returns 200 once the sink is up; a delivered
+#      alert appears as a message whose Subject matches the fired alertname.)
+#
+# Mailpit stores messages in memory (no PVC, no persistence) — a leaked namespace
+# leaves nothing behind, and chainsaw's per-test namespace teardown removes it.
+# =============================================================================
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: smtp-sink
+  labels:
+    app.kubernetes.io/name: smtp-sink
+    app.kubernetes.io/part-of: conformance-alerting
+    conformance.home.k3s/fixture: smtp-sink
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: smtp-sink
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: smtp-sink
+        app.kubernetes.io/part-of: conformance-alerting
+    spec:
+      # Hermetic, disposable capture sink — no state worth protecting.
+      automountServiceAccountToken: false
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 1000
+        seccompProfile:
+          type: RuntimeDefault
+      containers:
+        - name: mailpit
+          image: axllent/mailpit:v1.21.8
+          imagePullPolicy: IfNotPresent
+          env:
+            # Bind SMTP + HTTP UI/API on the well-known conformance ports.
+            - name: MP_SMTP_BIND_ADDR
+              value: "0.0.0.0:1025"
+            - name: MP_UI_BIND_ADDR
+              value: "0.0.0.0:8025"
+            # In-memory store: no disk, cleared on pod restart (hermetic per-run).
+            - name: MP_MAX_MESSAGES
+              value: "500"
+          ports:
+            - name: smtp
+              containerPort: 1025
+              protocol: TCP
+            - name: http
+              containerPort: 8025
+              protocol: TCP
+          readinessProbe:
+            httpGet:
+              path: /readyz
+              port: http
+            initialDelaySeconds: 2
+            periodSeconds: 3
+            timeoutSeconds: 2
+          livenessProbe:
+            httpGet:
+              path: /livez
+              port: http
+            initialDelaySeconds: 5
+            periodSeconds: 10
+          resources:
+            requests:
+              cpu: 25m
+              memory: 32Mi
+            limits:
+              cpu: 100m
+              memory: 128Mi
+          securityContext:
+            allowPrivilegeEscalation: false
+            readOnlyRootFilesystem: true
+            capabilities:
+              drop:
+                - ALL
+          volumeMounts:
+            - name: tmp
+              mountPath: /tmp
+      volumes:
+        - name: tmp
+          emptyDir: {}
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: smtp-sink
+  labels:
+    app.kubernetes.io/name: smtp-sink
+    app.kubernetes.io/part-of: conformance-alerting
+spec:
+  selector:
+    app.kubernetes.io/name: smtp-sink
+  ports:
+    - name: smtp
+      port: 1025
+      targetPort: smtp
+      protocol: TCP
+    - name: http
+      port: 8025
+      targetPort: http
+      protocol: TCP