feat(seal-check): enumeration label contract + storage-assertions test hook (RFC-0003 §8.2–8.4)

client/templates/_helpers.tpl

@@ -21,6 +21,38 @@ app.kubernetes.io/instance: {{ .Release.Name }}
 {{ .Release.Name }}-secrets
 {{- end }}
 
+{{/*
+  tracebloc.sealCheckLabels — the seal-check enumeration contract
+  (RFC-0003 §8.2 / backend#1184; consumed by the tracebloc CLI, cli#393).
+
+  Every runnable conformance check in this chart is a `helm.sh/hook: test` Job
+  carrying these two labels, so tooling can enumerate the suite without
+  hardcoding job names:
+
+    tracebloc.io/seal-check: "true"        — membership marker
+    tracebloc.io/seal-check-name: <check>  — stable per-check identifier
+
+  Current check names: egress-enforcement, backend-reachability,
+  storage-assertions.
+
+  Enumerate without running anything:   helm get hooks <release>
+  While a `helm test` run is live:      kubectl get jobs,pods -n <ns> \
+                                          -l tracebloc.io/seal-check=true
+
+  CONTRACT RULES — the label keys and existing check names are public API:
+  never rename them; add new checks under new names. Apply this helper to the
+  hook Job metadata AND its pod template (pod-level lets the CLI stream logs by
+  label). Do NOT apply it to auxiliary hook resources (ServiceAccounts, RBAC) —
+  only runnable checks are enumerable. See docs/SEAL-CHECK.md.
+
+  Usage:
+    {{- include "tracebloc.sealCheckLabels" (dict "name" "storage-assertions") | nindent 4 }}
+*/}}
+{{- define "tracebloc.sealCheckLabels" -}}
+tracebloc.io/seal-check: "true"
+tracebloc.io/seal-check-name: {{ .name | quote }}
+{{- end }}
+
 {{- define "tracebloc.serviceAccountName" -}}
 {{ .Release.Name }}-jobs-manager
 {{- end }}

client/templates/egress-enforcement-check.yaml

@@ -21,6 +21,8 @@ metadata:
   namespace: {{ .Release.Namespace }}
   labels:
     {{- include "tracebloc.labels" . | nindent 4 }}
+    {{- /* seal-check enumeration contract (RFC-0003 §8.2) — see _helpers.tpl */}}
+    {{- include "tracebloc.sealCheckLabels" (dict "name" "egress-enforcement") | nindent 4 }}
   annotations:
     "helm.sh/hook": test
     "helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded
@@ -31,6 +33,7 @@ spec:
     metadata:
       labels:
         {{- include "tracebloc.selectorLabels" . | nindent 8 }}
+        {{- include "tracebloc.sealCheckLabels" (dict "name" "egress-enforcement") | nindent 8 }}
         tracebloc.io/workload: training
     spec:
       restartPolicy: Never

client/templates/egress-reachability-check.yaml

@@ -30,6 +30,8 @@ metadata:
   namespace: {{ .Release.Namespace }}
   labels:
     {{- include "tracebloc.labels" . | nindent 4 }}
+    {{- /* seal-check enumeration contract (RFC-0003 §8.2) — see _helpers.tpl */}}
+    {{- include "tracebloc.sealCheckLabels" (dict "name" "backend-reachability") | nindent 4 }}
   annotations:
     "helm.sh/hook": test
     "helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded
@@ -40,6 +42,7 @@ spec:
     metadata:
       labels:
         {{- include "tracebloc.selectorLabels" . | nindent 8 }}
+        {{- include "tracebloc.sealCheckLabels" (dict "name" "backend-reachability") | nindent 8 }}
     spec:
       restartPolicy: Never
       automountServiceAccountToken: false

client/tests/egress_enforcement_check_test.yaml

@@ -51,6 +51,25 @@ tests:
           path: metadata.annotations["helm.sh/hook-delete-policy"]
           value: before-hook-creation,hook-succeeded
 
+  - it: carries the seal-check enumeration labels on the Job AND its pod (contract for cli#393)
+    set:
+      networkPolicy:
+        training:
+          allowExternalHttps: false
+    asserts:
+      - equal:
+          path: metadata.labels["tracebloc.io/seal-check"]
+          value: "true"
+      - equal:
+          path: metadata.labels["tracebloc.io/seal-check-name"]
+          value: egress-enforcement
+      - equal:
+          path: spec.template.metadata.labels["tracebloc.io/seal-check"]
+          value: "true"
+      - equal:
+          path: spec.template.metadata.labels["tracebloc.io/seal-check-name"]
+          value: egress-enforcement
+
   - it: probe pod is training-labelled (so the lockdown netpol governs it) and PSA-restricted
     set:
       networkPolicy:

client/tests/egress_reachability_check_test.yaml

@@ -29,6 +29,21 @@ tests:
       - hasDocuments:
           count: 0
 
+  - it: carries the seal-check enumeration labels on the Job AND its pod (contract for cli#393)
+    asserts:
+      - equal:
+          path: metadata.labels["tracebloc.io/seal-check"]
+          value: "true"
+      - equal:
+          path: metadata.labels["tracebloc.io/seal-check-name"]
+          value: backend-reachability
+      - equal:
+          path: spec.template.metadata.labels["tracebloc.io/seal-check"]
+          value: "true"
+      - equal:
+          path: spec.template.metadata.labels["tracebloc.io/seal-check-name"]
+          value: backend-reachability
+
   - it: is NOT labelled as a training workload (keeps its own egress)
     asserts:
       - notExists: