K2 DONE: L2 network behavior tests pass against the live cluster

R-NET-01 default-deny + R-NET-02 deny-undeclared PASS via run.sh (JUnit+coverage,
exit 0). Fixed 3 real bugs found by running them:
- chainsaw strict list-matching: assert scalar 'phase: Running' not a conditions[] element.
- default-deny blocks the kubelet readiness probe -> drop probes (dest pods just need to run).
- chainsaw report path ../_artifacts resolved to repo-root -> fix to _artifacts (was exit 1).
- swap agnhost->busybox httpd listeners (cached everywhere; cache-timing-proof).
Logged the kubelet-probe finding for WS-NET's T-2.2 default-deny baseline design.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

conformance/config/chainsaw-config.yaml

@@ -46,4 +46,6 @@ spec:
   report:
     format: JUNIT-TEST
     name: chainsaw-report
-    path: ../_artifacts
+    # relative to run.sh's CWD (conformance/), which creates this dir; ../_artifacts
+    # wrongly resolved to repo-root/_artifacts and made chainsaw exit 1 on report write.
+    path: _artifacts