Add container-workload-render L1 test (R-PLAT-02)

The renderer's PaaS path (kind: container) had no verifying conformance test — the
R-PLAT-02 token appears only in renderer comments, so a change touching catalog/
surfaced it as an uncovered touched-requirement (blocking the merge gate). Adds the
container render analog of vm-lifecycle (R-PLAT-03): asserts a kind: container
ServiceDefinition renders a Deployment (running the declared image) + a Service,
with the egress-class/auth-mode labels admission requires. Offline render-check.sh,
wrapped by a chainsaw Test for in-cluster runs.

Co-Authored-By: Claude Opus 4.8 <[email protected]>

conformance/tests/l1-rendering/container-workload-render/fixtures/svcdef.yaml

@@ -0,0 +1,14 @@
+# L1 fixture: a minimal kind: container ServiceDefinition — the PaaS path (R-PLAT-02).
+# It must render a Deployment (the container workload) + a Service for its exposed port.
+# Validates against schemas/servicedefinition.schema.json.
+name: paas-demo
+kind: container
+source:
+  image: nginx:1.27
+ingressRoutes:
+  - host: paas-demo.home.keithjackson.dev
+    port: 8080
+auth:
+  mode: forward-auth
+  groups:
+    - platform-admins