test(conformance): correct stale ImageVolume-gate rationale for k3s v1.36.4

The three KubeVirt VM conformance tests (vm-lifecycle, vm-default-deny,
vm-data-survival) carried comments asserting the ALPHA `ImageVolume` feature
gate is DISABLED "on this k3s v1.31 cluster" and that the apiserver therefore
prunes the container-disk `image` volume, breaking the containerDisk boot path.

The cluster was upgraded v1.31 -> v1.36.4. Revalidated the gate live:
  - kubernetes_feature_enabled{name="ImageVolume"} = 1 (enabled by default;
    stage="" — no longer ALPHA)
  - a server-side `kubectl apply --dry-run=server` of a Pod with an `image`
    volume RETAINS the volume + mount instead of pruning them.

So the old premise is stale: containerDisk roots would boot on 1.36.4. The
tests never asserted the gate state and never used containerDisk — they boot
from CDI DataVolume roots, which remains the correct choice because it is the
spec-required, rebuild-surviving disk model (docs/06, R-STATE-01); an ephemeral
containerDisk could never satisfy data-survival. Test logic is therefore
unchanged; only the explanatory comments are corrected (v1.31 -> v1.36.4, and
the "containerDisk is broken here" rationale marked stale with the live
evidence).

Merge gate: PASS (lint, l0, render-golden, l1 green).

Co-Authored-By: Claude Opus 4.8 <[email protected]>

conformance/tests/l2-behavioral/vm-lifecycle/chainsaw-test.yaml

@@ -21,19 +21,25 @@
 # (hermetic).
 #
 # DISK MODEL — CDI DataVolume on Longhorn (NOT an ephemeral containerDisk):
-#   KubeVirt v1.9 supplies the container-disk binary to the `volumerootdisk` init
-#   container via a Kubernetes-native `image` volume (VolumeSource.Image) mounted at
-#   /container-disk-binary. That k8s feature is gated by the ALPHA `ImageVolume`
-#   feature gate, which is DISABLED on this k3s v1.31 cluster — so the apiserver
-#   silently PRUNES the image volume + its mount, the binary is never present, and a
-#   containerDisk VM dies at OCI init with:
-#     exec: "/container-disk-binary/usr/bin/container-disk": no such file or directory
-#   A DataVolume-backed root is a mounted Longhorn PVC (CDI imports the same Fedora
-#   image into it out-of-band via its importer pod) and therefore does NOT touch the
-#   container-disk binary / image-volume path at all — it boots on this cluster. It is
-#   also the disk model the SPEC requires for VMs (docs/06, R-STATE-01: Longhorn-backed
-#   disks that survive rebuild), so this mirrors the representative fixtures/vm.yaml.
-#   Cost: a one-time CDI import per run (covered by the raised exec timeout below).
+#   The SPEC requires VMs to use Longhorn-backed disks that survive rebuild (docs/06,
+#   R-STATE-01), so this test — like fixtures/vm.yaml and the L3 vm-data-survival partner
+#   — boots from a CDI DataVolume on a Longhorn PVC (CDI imports the Fedora image into it
+#   out-of-band via its importer pod, so the VM never touches the container-disk binary /
+#   image-volume path). Cost: a one-time CDI import per run (covered by the raised exec
+#   timeout below).
+#   FEATURE-GATE NOTE (revalidated 2026-08 — the original "containerDisk is broken here"
+#   rationale is now STALE): KubeVirt v1.9 supplies the container-disk binary to the
+#   `volumerootdisk` init container via a Kubernetes-native `image` volume
+#   (VolumeSource.Image) mounted at /container-disk-binary, gated by the `ImageVolume`
+#   feature gate. On the ORIGINAL k3s v1.31 cluster that ALPHA gate was DISABLED, so the
+#   apiserver silently PRUNED the image volume + its mount and a containerDisk VM died at
+#   OCI init ("/container-disk-binary/usr/bin/container-disk: no such file or directory").
+#   The cluster is now k3s v1.36.4, where ImageVolume is ENABLED by default
+#   (kubernetes_feature_enabled{name="ImageVolume"}=1; a server-side dry-run of a Pod with
+#   an `image` volume RETAINS the volume + mount instead of pruning them). containerDisk
+#   roots would therefore boot on this cluster now — but DataVolume is retained regardless,
+#   because only it (not an ephemeral containerDisk) is the rebuild-surviving, spec-required
+#   disk model.
 # =============================================================================
 apiVersion: chainsaw.kyverno.io/v1alpha1
 kind: Test