T-0.4 Chainsaw conformance harness + coverage + behavior scaffolds (R-TEST-01..06)

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

conformance/versions.env

@@ -0,0 +1,20 @@
+# Pinned tool versions for the conformance harness (R-TEST-02: deterministic).
+# The harness is only reproducible if the toolchain is pinned. Bumps flow through the
+# normal update path (ADR-0011) with the suite re-green as the gate — never bumped
+# silently. `run.sh` sources this file; the in-cluster Chainsaw Job image (see
+# incluster/chainsaw-job.yaml) MUST use the same CHAINSAW_VERSION.
+
+# Chainsaw — L1 rendering / L2 behavioral / L3 fault-injection runner (ADR-0011).
+CHAINSAW_VERSION="v0.2.12"
+CHAINSAW_IMAGE="ghcr.io/kyverno/chainsaw:v0.2.12"
+
+# kubectl — used by run.sh for cluster reachability preflight and by probe scripts.
+KUBECTL_VERSION="v1.31.4"
+
+# Kyverno CLI — L0 static/policy gate (owned by T-0.5, referenced here for a single
+# pinned toolchain view). Not invoked by run.sh yet.
+KYVERNO_VERSION="v1.13.2"
+
+# Python 3 — coverage generator + JUnit emitter use stdlib only (no pip deps), so the
+# only constraint is a modern interpreter.
+PYTHON_MIN="3.9"