test: migrate workload-api-acceptance from infra (WIP)

[ecv]

WIP / DRAFT — not intended to be green CI yet. See "Known-uncertain" below.

What

Migrates the workload-api-acceptance Chainsaw test out of datum-cloud/infra
into this repo (the owner of the compute.datumapis.com Workload contract), and
introduces a minimal Chainsaw harness to compute, which currently has none.

• New test: test/e2e/workload-api-acceptance/ (chainsaw test + location.yaml,
  network.yaml, workload.yaml fixtures copied from infra).
• Applies a Workload (plus networking Location/Network fixtures) and asserts
  the control plane accepts and stores the Workload — API schema + admission
  only, no wait for VM provisioning.
• Makefile: adds kind + chainsaw tool vars/versions/install targets and a
  make test-chainsaw target that runs chainsaw test ./test/e2e against a local
  kind cluster (mirrors datum-cloud/network-services-operator).

Why

datum-cloud/infra#3006 consolidates infra's live-env Chainsaw suite into one
"construct" group and evacuates single-service API-contract tests to their owning
repos, to be run against the local kind harness pre-merge. This test validates a
compute.datumapis.com contract owned by this repo.

Related: datum-cloud/infra#3006, datum-cloud/infra#3005.

Adaptations from the infra original

• Removed the datumctl auth update-kubeconfig setup step and the
  clusters: / cluster: project blocks referencing ./test-kubeconfig.
• Target a local kind cluster via spec.cluster: compute-e2e, mirroring NSO.
• Removed spec.skip: true.

Introduces Chainsaw to compute — decision to confirm

Compute has no Chainsaw harness today; its only e2e is the kubebuilder Go
suite (test/e2e/e2e_test.go, make test-e2e, currently a stub). This PR adds a
proposed, WIP Chainsaw harness. The compute team should decide:

• (A) adopt Chainsaw for API-contract e2e (this PR), or
• (B) re-express these contract assertions inside the existing Go/kubebuilder
  e2e and drop the Chainsaw wiring.

The harness wiring here is deliberately minimal and marked WIP so the migration is
reviewable regardless of which path is chosen.

Known-uncertain

• Networking CRDs / controller are not in this repo. The fixtures use
  networking.datumapis.com (Location, Network). A compute-only local kind
  env will not serve these unless NSO CRDs are installed first. The harness does
  not install them yet — this needs a decision (install NSO CRDs in the e2e
  bring-up, or drop the networking fixtures).
• The Workload validating webhook lists LocationBinding
  (networking.datumapis.com) during ValidateCreate and derives valid city
  codes from LocationBinding.Spec.Topology["topology.datum.net/city-code"]. So:
  • the webhook needs the networking CRDs present, and
  • cityCodes: [ORD] requires a matching LocationBinding (the infra
    fixture applies a Location, not a LocationBinding) or admission fails
    Invalid. This is the same class of failure that had the original test
    skip: true (infra #2733). Resolving it (add a LocationBinding fixture,
    or run the webhook with location validation relaxed) is left for the
    compute-team review.
• spec.cluster name is assumed to be compute-e2e. Compute's current CI
  creates a default-named kind cluster (kind create cluster → kind). The
  Makefile exposes KIND_CLUSTER ?= compute-e2e; the e2e bring-up should create a
  cluster of that name (or override the var).
• Kind/Chainsaw versions pinned to match NSO (kind v0.27.0,
  chainsaw v0.2.15); adjust to compute's preference.

[ecv]

⚠️ Action required before this leaves draft

1. Networking dependency in Workload admission. The Workload validating webhook
   (internal/webhook/v1alpha/workload_webhook.go) lists networking.datumapis.com
LocationBinding in ValidateCreate and validates cityCodes: [ORD] against
   LocationBinding.Spec.Topology. A compute-only e2e env has no networking CRDs or
   controller, and the infra fixture only supplies a Location (not a LocationBinding).
   Decide: install the networking CRDs + seed a matching LocationBinding in the e2e
   env, or gate/relax admission for the test. This is the same blocker class that had the
   originals skip: true (infra #2733).
2. Chainsaw-vs-Go-e2e decision. This PR introduces Chainsaw to compute (mirroring
   NSO) rather than extending the existing Go/kubebuilder e2e. Compute team needs to
   confirm that direction before merge — the harness wiring here is intentionally minimal.

Not green CI by design (draft). Tracks datum-cloud/infra#3006.