T-0.4 Chainsaw conformance harness + coverage + behavior scaffolds (R-TEST-01..06)

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

conformance/config/chainsaw-config.yaml

@@ -0,0 +1,49 @@
+# Chainsaw Configuration for the home-k3s conformance suite (ADR-0011).
+# Passed to every invocation via `chainsaw test --config config/chainsaw-config.yaml`
+# so local runs and the in-cluster CI Job behave identically (R-TEST-02).
+#
+# Reproducibility knobs live here, NOT in individual tests, so the whole suite shares
+# one deterministic execution contract:
+#   * bounded timeouts (no sleep-and-hope; eventual consistency via polled assert/error)
+#   * per-test ephemeral namespace, auto-created and auto-deleted (hermetic, isolated)
+#   * a leaked fixture is a failure: del/cleanup timeouts are enforced, skipDelete=false
+apiVersion: chainsaw.kyverno.io/v1alpha2
+kind: Configuration
+metadata:
+  name: home-k3s-conformance
+spec:
+  # -- Deterministic bounded waits. Eventual consistency is handled by polling within
+  #    these windows (assert/error retry until deadline), never by fixed sleeps.
+  timeouts:
+    apply: 90s
+    assert: 180s
+    error: 60s
+    delete: 120s
+    cleanup: 120s
+    exec: 180s
+
+  # -- Isolation & parallel-safety: each test gets its own generated namespace so tests
+  #    never collide and can run concurrently.
+  namespace:
+    # Unique per test run; prefix makes leaked namespaces obvious in `kubectl get ns`.
+    template:
+      metadata:
+        generateName: chainsaw-conf-
+
+  # -- Concurrency. Tests are hermetic, so they parallelize safely; keep modest to bound
+  #    cluster load and keep fault-injection tests from contending.
+  execution:
+    parallel: 4
+    # Fail the whole run if any test leaks a namespace/fixture (reproducibility contract).
+    failFast: false
+
+  # -- Self-cleaning: never skip delete; deletion is part of the pass criteria.
+  cleanup:
+    skipDelete: false
+
+  # -- Machine-readable output. run.sh normalizes the emitted file to
+  #    _artifacts/report.junit.xml and layers the requirement-coverage report on top.
+  report:
+    format: JUNIT-TEST
+    name: chainsaw-report
+    path: ../_artifacts