chore(seal-check): adopt e2e-common lib + pin probe HOST (#541 fast-follow)

[LukasWodka]

#541 fast-follow (promised on review)

Now that #550 (shared e2e-common.sh) and #541 (the seal-check runner) are both on develop:

• e2e-seal-check.sh adopts the shared lib — sources scripts/tests/lib/e2e-common.sh and uses e2e_isolate_env / e2e_install_prereqs like the other e2e-*.sh (drops the inlined isolation-env + install block). Keeps its own NS=$CLUSTER_NAME and local fail().
• HOST hardening (@saqlainsyed007 nit): the probe host is now a single $HOST var that the install pins via --set networkPolicy.training.enforcementProbeHost="$HOST" AND the positive control targets — so the enforcement probe and the positive control can never drift onto different hosts (was: HOST hardcoded while the probe used the chart default).

Verified: shellcheck --severity=error/warning clean; helm template renders the probe Job with HOST=1.1.1.1 pinned + TIMEOUT=240. Targets develop.

🤖 Generated with Claude Code

---

Note

Low Risk
Test-harness refactor and explicit Helm value for probe host; no production runtime or auth changes.

Overview
e2e-seal-check.sh now follows the same bring-up pattern as the other e2e-*.sh scripts by sourcing scripts/tests/lib/e2e-common.sh and calling e2e_isolate_env tbseal and e2e_install_prereqs instead of inlined cluster isolation and kubectl/k3d/helm install logic. Script-specific pieces (NS=$CLUSTER_NAME, local fail(), chart install, and seal-check flow) are unchanged.

The egress probe host is a single $HOST (1.1.1.1) passed to Helm via --set networkPolicy.training.enforcementProbeHost="$HOST", so the chart enforcement Job and the positive-control curl in default always target the same host—avoiding drift between a hardcoded control and the chart default.

^{Reviewed by Cursor Bugbot for commit c263ac7. Bugbot is set up for automated code reviews on this repo. Configure here.}

[LukasWodka]

bugbot run

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit c263ac7. Configure here.}

[saqlainsyed007]

Reviewed at high effort (8 finder angles + cross-file/removed-behavior trace). This holds up well — clean, well-scoped fast-follow.

What I verified:

• The deleted inlined isolation + prereq block is faithfully reproduced by e2e_isolate_env / e2e_install_prereqs; the only net changes are the intentional export USER and fail→error for the docker check (both exit 1, both matching the sibling e2e-*.sh).
• Sourcing contract respected: e2e_install_prereqs (resolves has/error/install_* at call time) runs after common.sh + setup-linux.sh are sourced, identical ordering to e2e-cluster.sh.
• The HOST pinning does what it claims — --set …enforcementProbeHost="$HOST" and the positive control both derive from the single HOST=1.1.1.1, closing the hardcoded-vs-chart-default drift.
• e2e-common.sh itself is untouched, so no other consumer of the shared helpers is affected.

No correctness issues. One optional maintainability nit inline — non-blocking; LGTM.

[saqlainsyed007]

LGTM — clean fast-follow. Verified the shared-lib adoption preserves the inlined behavior (only the intentional export USER and fail→error deltas), the sourcing/call ordering matches the sibling e2e scripts, and the single HOST=1.1.1.1 now feeds both the Helm --set and the positive control so the probe/control can no longer drift. The one inline note is optional/non-blocking.

[LukasWodka]

/fr-pass