fix(conformance): busybox-compatible wget in oidc-sso-grafana probe (R-IDP-01)

busybox wget has no --max-redirect flag → it printed usage, so the probe never saw the
302 and R-IDP-01 falsely failed. Grafana verified live: /login/generic_oauth 302s to the
Keycloak homelab authorize endpoint. Use 'wget -S' (dumps the 302 Location before follow).

conformance/tests/l2-behavioral/oidc-sso-grafana/chainsaw-test.yaml

@@ -65,7 +65,11 @@ spec:
                           - |
                             set -u
                             svc="http://kube-prometheus-stack-grafana.monitoring.svc.cluster.local"
-                            out="$(wget -S --max-redirect=0 -O /dev/null "$svc/login/generic_oauth" 2>&1 || true)"
+                            # busybox wget has no --max-redirect; -S dumps every response header
+                            # (incl. the initial 302 Location to the IdP) before following, so the
+                            # grep below still matches the Keycloak authorize URL. (Grafana verified
+                            # live: 302 -> keycloak.home.keithjackson.dev/realms/homelab/.../auth.)
+                            out="$(wget -S -O /dev/null "$svc/login/generic_oauth" 2>&1 || true)"
                             echo "$out"
                             if echo "$out" | grep -qi 'keycloak.home.keithjackson.dev/realms/homelab'; then
                               echo GRAFANA_OIDC_REDIRECT_OK