K2 DONE: L2 network behavior tests pass against the live cluster

R-NET-01 default-deny + R-NET-02 deny-undeclared PASS via run.sh (JUnit+coverage,
exit 0). Fixed 3 real bugs found by running them:
- chainsaw strict list-matching: assert scalar 'phase: Running' not a conditions[] element.
- default-deny blocks the kubelet readiness probe -> drop probes (dest pods just need to run).
- chainsaw report path ../_artifacts resolved to repo-root -> fix to _artifacts (was exit 1).
- swap agnhost->busybox httpd listeners (cached everywhere; cache-timing-proof).
Logged the kubelet-probe finding for WS-NET's T-2.2 default-deny baseline design.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

conformance/tests/l2-behavioral/deny-undeclared/chainsaw-test.yaml

@@ -44,18 +44,20 @@ spec:
               kind: Pod
               metadata: { name: declared-dest }
               status:
-                conditions:
-                  - type: Ready
-                    status: "True"
+                # scalar match — chainsaw does strict (length-equal) list matching, so asserting a
+                # single condition against the pod's full conditions[] list fails. Running is enough:
+                # the listener is up once the container runs (no readinessProbe under default-deny).
+                phase: Running
         - assert:
             resource:
               apiVersion: v1
               kind: Pod
               metadata: { name: other-dest }
               status:
-                conditions:
-                  - type: Ready
-                    status: "True"
+                # scalar match — chainsaw does strict (length-equal) list matching, so asserting a
+                # single condition against the pod's full conditions[] list fails. Running is enough:
+                # the listener is up once the container runs (no readinessProbe under default-deny).
+                phase: Running
 
     # -- THEN(declared succeeds): source -> declared-dest:8080 connects. Green Job = allowed.
     - name: then-declared-succeeds