Add container-workload-render L1 test (R-PLAT-02)

The renderer's PaaS path (kind: container) had no verifying conformance test — the
R-PLAT-02 token appears only in renderer comments, so a change touching catalog/
surfaced it as an uncovered touched-requirement (blocking the merge gate). Adds the
container render analog of vm-lifecycle (R-PLAT-03): asserts a kind: container
ServiceDefinition renders a Deployment (running the declared image) + a Service,
with the egress-class/auth-mode labels admission requires. Offline render-check.sh,
wrapped by a chainsaw Test for in-cluster runs.

Co-Authored-By: Claude Opus 4.8 <[email protected]>

conformance/tests/l1-rendering/container-workload-render/chainsaw-test.yaml

@@ -0,0 +1,36 @@
+# =============================================================================
+# L1 RENDERING — kind: container renders the PaaS workload (R-PLAT-02)
+# Catalog: docs/13 `kind: container` (PaaS default). The render analog of the
+# vm-lifecycle (R-PLAT-03) test for the container path.
+#
+# GIVEN a kind: container ServiceDefinition,
+# WHEN  the renderer produces resources,
+# THEN  it renders a Deployment (the container workload) + a Service, matching the
+#       golden, with the egress-class + auth-mode labels admission requires.
+#
+# STATUS: IMPLEMENTED (T-0.3). render-check.sh is a pure offline check (renderer +
+# golden diff + structural asserts, no cluster). conformance/run.sh --layer l1 and
+# ci/l1.sh run it directly; this Chainsaw Test wraps the SAME script so an in-cluster
+# run executes the identical assertion. Rendering != enforcement (behavior at L2).
+# =============================================================================
+apiVersion: chainsaw.kyverno.io/v1alpha1
+kind: Test
+metadata:
+  name: container-workload-render
+  labels:
+    conformance.home.k3s/R-PLAT-02: "true"
+  annotations:
+    conformance.home.k3s/requirements: "R-PLAT-02"
+    conformance.home.k3s/layer: "L1"
+    conformance.home.k3s/safety-critical: "false"
+    conformance.home.k3s/intent: >-
+      A kind: container ServiceDefinition renders a Deployment + Service (the PaaS path).
+spec:
+  steps:
+    - name: render-and-assert-container-workload
+      description: >-
+        Render a container ServiceDefinition and assert it produces a Deployment running
+        the declared image plus a Service, with the required pod labels, matching golden.
+      try:
+        - script:
+            content: bash ./render-check.sh