T-0.4 Chainsaw conformance harness + coverage + behavior scaffolds (R-TEST-01..06)

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

conformance/tests/l2-behavioral/vm-lifecycle/chainsaw-test.yaml

@@ -0,0 +1,46 @@
+# =============================================================================
+# L2 BEHAVIORAL SCAFFOLD — VM lifecycle  (R-PLAT-03)
+# Catalog: docs/14 "VM lifecycle (R-PLAT-03, L2/L3)"
+#
+# GIVEN a `kind: vm` ServiceDefinition,
+# WHEN  it is created/started/stopped/destroyed via kubectl/virtctl,
+# THEN  it behaves through the same K8s surface; default-deny + egress class
+#       apply to it. (Disk-survives-rebuild is the L3 partner test, see
+#       tests/l3-fault-injection/data-survival — VMs share R-STATE-01.)
+#
+# STATUS: scaffold — needs T-5.1/T-5.2 (KubeVirt + `kind: vm` path).
+# =============================================================================
+apiVersion: chainsaw.kyverno.io/v1alpha1
+kind: Test
+metadata:
+  name: vm-lifecycle
+  labels:
+    conformance.home.k3s/R-PLAT-03: "true"
+  annotations:
+    conformance.home.k3s/requirements: "R-PLAT-03"
+    conformance.home.k3s/layer: "L2"
+    conformance.home.k3s/safety-critical: "false"
+    conformance.home.k3s/intent: >-
+      A VM is created/started/stopped/destroyed via the K8s API; policy applies.
+spec:
+  steps:
+    - name: given-vm-servicedefinition
+      try:
+        - apply:
+            file: fixtures/vm-servicedefinition.yaml   # TODO(T-5.2): author
+    - name: when-start-and-assert-running
+      try:
+        - script:
+            content: |
+              set -euo pipefail
+              # virtctl start via the same kubectl surface; assert VMI Running.
+              kubectl -n "$NAMESPACE" patch vm demo --type merge -p '{"spec":{"running":true}}'
+              echo "TODO(T-5.3): wait VMI phase=Running (bounded), then STARTED_OK"
+    - name: then-default-deny-and-egress-apply-to-vm
+      try:
+        - script:
+            content: 'echo "TODO: run default-deny + egress-class probes from inside the VM"'
+    - name: when-stop-and-destroy
+      try:
+        - script:
+            content: 'echo "TODO(T-5.3): stop then delete VM via kubectl; assert gone"'