fix(conformance): chainsaw checks use contains(), not unsupported =~

Every chainsaw `check` used the regex operator `=~` (`($stdout =~ 'X'): true`),
which chainsaw's expression engine rejects ('SyntaxError: Unknown char: ~') — so
EVERY such test failed on the assertion even when the behavior passed. Proven with
data-survival (R-STATE-01): the Longhorn canary genuinely SURVIVED pod destruction
(DATA_SURVIVED_OK) but the test FAILED on the `=~` syntax. Converted all 10 tests to
JMESPath `contains($stdout, 'X')` (data-survival's alternation → contains||contains).
data-survival now PASSES; the other 9 (later-phase components) are syntactically fixed
for when their phases deploy.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

conformance/tests/l3-fault-injection/alerting/chainsaw-test.yaml

@@ -48,7 +48,7 @@ spec:
               set -euo pipefail
               echo "TODO: query smtp-sink for an email whose subject matches the alert"
               echo "EMAIL_DELIVERED_OK"
-            check: { ($stdout =~ 'EMAIL_DELIVERED_OK'): true }
+            check: { (contains($stdout, 'EMAIL_DELIVERED_OK')): true }
       finally:
         - script:
             content: 'echo "TODO: clear the injected fault + drain the sink (self-cleaning)"'

conformance/tests/l3-fault-injection/data-survival/chainsaw-test.yaml

@@ -103,7 +103,7 @@ spec:
               [ "$GOT" = "$CANARY" ] && echo DATA_SURVIVED_OK
             check:
               # green on either a clean skip (no longhorn) or a proven survival.
-              ($stdout =~ '(DATA_SURVIVED_OK|DATA_SURVIVAL_SKIPPED_OK)'): true
+              (contains($stdout, 'DATA_SURVIVED_OK') || contains($stdout, 'DATA_SURVIVAL_SKIPPED_OK')): true
       finally:
         - script:
             content: |

conformance/tests/l3-fault-injection/default-deny-failclosed/chainsaw-test.yaml

@@ -40,7 +40,7 @@ spec:
             content: |
               set -euo pipefail
               kubectl -n "$NAMESPACE" exec source -- nc -z -w 3 dest 80 && echo ALLOWED_OK
-            check: { ($stdout =~ 'ALLOWED_OK'): true }
+            check: { (contains($stdout, 'ALLOWED_OK')): true }
     - name: when-revoke-allow-then-fail-closed
       try:
         # FAULT INJECTION: delete the allow policy; baseline default-deny remains.
@@ -56,13 +56,13 @@ spec:
                 echo "LEAK: still reachable after allow revoked" >&2; exit 1
               fi
               echo FAIL_CLOSED_OK
-            check: { ($stdout =~ 'FAIL_CLOSED_OK'): true }
+            check: { (contains($stdout, 'FAIL_CLOSED_OK')): true }
         - script:
             # DNS must still work (default-deny permits DNS egress).
             content: |
               set -euo pipefail
               kubectl -n "$NAMESPACE" exec source -- nslookup kubernetes.default && echo DNS_OK
-            check: { ($stdout =~ 'DNS_OK'): true }
+            check: { (contains($stdout, 'DNS_OK')): true }
       finally:
         - script:
             content: 'echo "cleanup via chainsaw namespace teardown"'

conformance/tests/l3-fault-injection/dr-restore/chainsaw-test.yaml

@@ -46,7 +46,7 @@ spec:
               set -euo pipefail
               echo "TODO: assert app Ready in restored ns AND canary data present"
               echo "DR_RESTORE_OK"
-            check: { ($stdout =~ 'DR_RESTORE_OK'): true }
+            check: { (contains($stdout, 'DR_RESTORE_OK')): true }
       finally:
         - script:
             content: 'echo "TODO: delete the restore target namespace (self-cleaning)"'

conformance/tests/l3-fault-injection/gitops-drift/chainsaw-test.yaml

@@ -45,7 +45,7 @@ spec:
               set -euo pipefail
               echo "TODO: within Flux interval, assert live value == git-declared value"
               echo "DRIFT_REVERTED_OK"
-            check: { ($stdout =~ 'DRIFT_REVERTED_OK'): true }
+            check: { (contains($stdout, 'DRIFT_REVERTED_OK')): true }
       finally:
         - script:
             content: 'echo "TODO: ensure resource left in git-declared state"'

conformance/tests/l3-fault-injection/hands-off-update/chainsaw-test.yaml

@@ -56,7 +56,7 @@ spec:
               echo "TODO: assert rolled back to last-good revision"
               echo "TODO: assert Alertmanager delivered an email alert (see alerting test)"
               echo "ROLLBACK_OK"
-            check: { ($stdout =~ 'ROLLBACK_OK'): true }
+            check: { (contains($stdout, 'ROLLBACK_OK')): true }
       finally:
         - script:
             content: 'echo "TODO: reset automation to a good tag (self-cleaning)"'

conformance/tests/l3-fault-injection/vpn-killswitch/chainsaw-test.yaml

@@ -51,14 +51,14 @@ spec:
                 echo "LEAK: vpn workload reached internet with tunnel down" >&2; exit 1
               fi
               echo NO_LEAK_OK
-            check: { ($stdout =~ 'NO_LEAK_OK'): true }
+            check: { (contains($stdout, 'NO_LEAK_OK')): true }
         - script:
             # AND: internet-class workload is unaffected.
             content: |
               set -euo pipefail
               kubectl -n "$NAMESPACE" exec egress-internet -- \
                 curl -fsS --max-time 5 https://api.ipify.org && echo INTERNET_UNAFFECTED_OK
-            check: { ($stdout =~ 'INTERNET_UNAFFECTED_OK'): true }
+            check: { (contains($stdout, 'INTERNET_UNAFFECTED_OK')): true }
     - name: when-tunnel-recovers-connectivity-returns
       try:
         - script: