ci: bake pinned test toolchain into devcontainer + fix conformance layer/spec-immutability seams

Bake the conformance harness toolchain into infra/devcontainer so `make -C ci gate`
runs identically here and in CI:
- Containerfile: install kyverno CLI (1.13.4), kyverno-json, chainsaw (0.2.12),
  yamllint (1.35.1), check-jsonschema (0.29.4), yq (4.44.6) via new pinned RUN block;
  add diffutils + python3-pip; drop stale LIBVIRT_DEFAULT_URI; refresh header for the
  Proxmox(bpg)+conformance toolbox; extend /etc/dev-toolchain-versions provenance.
- versions.env: add KYVERNO/KYVERNO_JSON/CHAINSAW/YAMLLINT/YQ/CHECK_JSONSCHEMA;
  align KUBECTL 1.32.0 -> 1.31.4. dev.sh build(): pass the new --build-args.
- ci/versions.env: pin CHECK_JSONSCHEMA_VERSION=0.29.4 (single source of truth).

Fix harness seams so the gate can run:
- dev.sh run(): mount the sibling spec repo (home-network-k3s) read-only at
  /home-network-k3s for ci/spec-immutability.sh (R-TEST-06); conditional so the
  container still runs without it.
- conformance/lib/common.sh conf_dirs_for_layer(): accept a comma/space list of
  layers and union the dirs, so ci/conformance.sh `run.sh --layer l2,l3` selects
  both layers in one pass (backward compatible for single layers).

NOTE: ci/versions.env pins KYVERNO_JSON_VERSION=0.0.5, which has no upstream release
(max tag is v0.0.3; platform/kyverno/scripts/run-l0.sh already defaults to v0.0.3).
Baked v0.0.3 and flagged for PM to correct ci/versions.env. kyverno-json is not used
by any static gate stage.

Co-Authored-By: Claude Opus 4.8 <[email protected]>

ci/conformance.sh

@@ -42,8 +42,10 @@ fi
 # NOT accept --junit/--coverage. This stage is CLUSTER-GATED (only runs when
 # CLUSTER_AVAILABLE=true, Phase 1+), so its trigger path is confirmed against a real
 # cluster in Phase 1 — TODO(Phase 1): drive the in-cluster Chainsaw Job
-# (conformance/incluster/chainsaw-job.yaml) under the narrow CONFORMANCE_TRIGGER_KUBECONFIG,
-# and confirm multi-layer (l2 + l3) selection syntax against run.sh. Artifacts are then
+# (conformance/incluster/chainsaw-job.yaml) under the narrow CONFORMANCE_TRIGGER_KUBECONFIG.
+# Multi-layer selection: `--layer l2,l3` selects BOTH layers in one run — conf_dirs_for_layer
+# (conformance/lib/common.sh) now unions a comma/space list of layers, so this is a single
+# invocation with one aggregated report (no per-layer looping needed). Artifacts are then
 # COLLECTED from the fixed location below.
 "$CONFORMANCE_CMD" --layer l2,l3 "${req_args[@]}"
 

ci/versions.env

@@ -20,3 +20,7 @@ CHAINSAW_VERSION="0.2.12"
 YAMLLINT_VERSION="1.35.1"
 KUBECTL_VERSION="1.31.4"
 YQ_VERSION="4.44.6"
+
+# ServiceDefinition JSON-Schema validation (schemas/validate.sh). Pip-installed;
+# pinned here so CI and a laptop validate against the exact same validator.
+CHECK_JSONSCHEMA_VERSION="0.29.4"