ci: bake pinned test toolchain into devcontainer + fix conformance layer/spec-immutability seams

Bake the conformance harness toolchain into infra/devcontainer so `make -C ci gate`
runs identically here and in CI:
- Containerfile: install kyverno CLI (1.13.4), kyverno-json, chainsaw (0.2.12),
  yamllint (1.35.1), check-jsonschema (0.29.4), yq (4.44.6) via new pinned RUN block;
  add diffutils + python3-pip; drop stale LIBVIRT_DEFAULT_URI; refresh header for the
  Proxmox(bpg)+conformance toolbox; extend /etc/dev-toolchain-versions provenance.
- versions.env: add KYVERNO/KYVERNO_JSON/CHAINSAW/YAMLLINT/YQ/CHECK_JSONSCHEMA;
  align KUBECTL 1.32.0 -> 1.31.4. dev.sh build(): pass the new --build-args.
- ci/versions.env: pin CHECK_JSONSCHEMA_VERSION=0.29.4 (single source of truth).

Fix harness seams so the gate can run:
- dev.sh run(): mount the sibling spec repo (home-network-k3s) read-only at
  /home-network-k3s for ci/spec-immutability.sh (R-TEST-06); conditional so the
  container still runs without it.
- conformance/lib/common.sh conf_dirs_for_layer(): accept a comma/space list of
  layers and union the dirs, so ci/conformance.sh `run.sh --layer l2,l3` selects
  both layers in one pass (backward compatible for single layers).

NOTE: ci/versions.env pins KYVERNO_JSON_VERSION=0.0.5, which has no upstream release
(max tag is v0.0.3; platform/kyverno/scripts/run-l0.sh already defaults to v0.0.3).
Baked v0.0.3 and flagged for PM to correct ci/versions.env. kyverno-json is not used
by any static gate stage.

Co-Authored-By: Claude Opus 4.8 <[email protected]>

infra/devcontainer/dev.sh

@@ -37,6 +37,12 @@ build() {
     --build-arg FLUX_VERSION="$FLUX_VERSION" \
     --build-arg KUBECTL_VERSION="$KUBECTL_VERSION" \
     --build-arg HELM_VERSION="$HELM_VERSION" \
+    --build-arg KYVERNO_VERSION="$KYVERNO_VERSION" \
+    --build-arg KYVERNO_JSON_VERSION="$KYVERNO_JSON_VERSION" \
+    --build-arg CHAINSAW_VERSION="$CHAINSAW_VERSION" \
+    --build-arg YAMLLINT_VERSION="$YAMLLINT_VERSION" \
+    --build-arg YQ_VERSION="$YQ_VERSION" \
+    --build-arg CHECK_JSONSCHEMA_VERSION="$CHECK_JSONSCHEMA_VERSION" \
     -t "$IMAGE" -f "${HERE}/Containerfile" "${HERE}"
 }
 
@@ -54,10 +60,22 @@ run() {
   if [ "${DEV_NO_TUNNEL:-0}" != "1" ]; then
     prelude="if [ -f /root/.ssh/home_network ]; then ssh -fN -L ${K3S_API_LOCAL_PORT}:127.0.0.1:6443 -p ${K3S_SSH_PORT} -i /root/.ssh/home_network -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -o ExitOnForwardFailure=yes -o ConnectTimeout=5 -o ServerAliveInterval=30 ${K3S_SSH_USER}@${K3S_SSH_HOST} 2>/dev/null || echo '[dev.sh] k3s API tunnel not up (cluster down or NAT changed?) — kubectl/flux/helm will not reach the cluster' >&2; fi"
   fi
+  # Spec repo (home-network-k3s) mount, read-only, for ci/spec-immutability.sh (R-TEST-06).
+  # That script reads SPEC_REPO (default ${REPO_ROOT}/../home-network-k3s); inside the
+  # container REPO_ROOT is /work, so the default resolves to /home-network-k3s. Mount the
+  # sibling spec repo there RO when it exists; skip the mount otherwise so the container
+  # still runs (the gate then honestly SKIPS immutability — exit 3, never faked green).
+  local -a spec_mount=()
+  local spec_host
+  spec_host="$(cd "${REPO_ROOT}/../home-network-k3s" 2>/dev/null && pwd || true)"
+  if [ -n "${spec_host}" ] && [ -d "${spec_host}/.git" ]; then
+    spec_mount=(-v "${spec_host}:/home-network-k3s:ro" -e SPEC_REPO=/home-network-k3s)
+  fi
   "$ENGINE" run --rm -it \
     --network host \
     --security-opt label=disable \
     -v "${REPO_ROOT}:/work" -w /work \
+    "${spec_mount[@]}" \
     -v "${HOME}/.ssh:/root/.ssh:ro" \
     -v "${HOME}/.config/sops:/root/.config/sops" \
     -v "${HOME}/.config/home-k3s/ansible-vault-pass:/root/.config/home-k3s/ansible-vault-pass:ro" \