feat(validator): upgrade conformance checks from static to behavioral validation

Upgrade 5 conformance checks from static/presence validation to
behavioral/functional testing per CNCF AI Conformance v1.34 section 11.1:

- cluster-autoscaling: Full behavioral chain — HPA scaling intent,
  Karpenter KWOK node provisioning, pod scheduling verification.
  Discovers GPU NodePools dynamically, tries each until one succeeds.
- pod-autoscaling: HPA reads external GPU metrics (dcgm_gpu_power_usage)
  and computes scale-up, Deployment actually scales replicas.
- inference-gateway: Data-plane readiness via EndpointSlice verification,
  HTTPRoute discovery (informational).
- robust-controller: Webhook rejection test — creates invalid
  DynamoGraphDeployment, verifies admission webhook rejects it.
- secure-accelerator-access: Negative isolation test — pod without
  ResourceClaims cannot access GPU devices.

Removes kwok/scripts/validate-cluster-autoscaling.sh (setup logic inlined
in CI workflows, exercise logic replaced by Go conformance check).

Author: dims

.github/workflows/gpu-h100-inference-test.yaml

@@ -39,7 +39,6 @@ on:
       - 'recipes/overlays/h100-kind-inference-dynamo.yaml'
       - 'kwok/manifests/karpenter/**'
       - 'kwok/scripts/install-karpenter-kwok.sh'
-      - 'kwok/scripts/validate-cluster-autoscaling.sh'
   workflow_dispatch: {}  # Allow manual runs
 
 permissions:
@@ -111,7 +110,10 @@ jobs:
       # --- Install Karpenter before validation so cluster-autoscaling check passes ---
 
       - name: Install Karpenter + KWOK (setup)
-        run: bash kwok/scripts/validate-cluster-autoscaling.sh --setup
+        run: |
+          export KARPENTER_VERSION=$(yq eval '.testing_tools.karpenter' .settings.yaml)
+          bash kwok/scripts/install-karpenter-kwok.sh
+          kubectl --context="kind-${KIND_CLUSTER_NAME}" apply -f kwok/manifests/karpenter/nodepool.yaml
 
       # --- Validate cluster (Go conformance checks run inside K8s Jobs) ---
       # Includes self-contained secure-accelerator-access check (creates its own
@@ -228,11 +230,6 @@ jobs:
           fi
           echo "Dynamo vLLM inference smoke test passed."
 
-      # --- Cluster Autoscaling validation ---
-
-      - name: Cluster Autoscaling (Karpenter + KWOK)
-        run: bash kwok/scripts/validate-cluster-autoscaling.sh --exercise
-
       # --- Evidence collection ---
 
       - name: Collect AI conformance evidence

.github/workflows/gpu-h100-training-test.yaml

@@ -35,7 +35,6 @@ on:
       - 'recipes/overlays/h100-kind-training.yaml'
       - 'kwok/manifests/karpenter/**'
       - 'kwok/scripts/install-karpenter-kwok.sh'
-      - 'kwok/scripts/validate-cluster-autoscaling.sh'
       - 'recipes/components/prometheus-adapter/**'
   workflow_dispatch: {}  # Allow manual runs
 
@@ -108,7 +107,10 @@ jobs:
       # --- Install Karpenter before validation so cluster-autoscaling check passes ---
 
       - name: Install Karpenter + KWOK (setup)
-        run: bash kwok/scripts/validate-cluster-autoscaling.sh --setup
+        run: |
+          export KARPENTER_VERSION=$(yq eval '.testing_tools.karpenter' .settings.yaml)
+          bash kwok/scripts/install-karpenter-kwok.sh
+          kubectl --context="kind-${KIND_CLUSTER_NAME}" apply -f kwok/manifests/karpenter/nodepool.yaml
 
       # --- Health checks (run before conformance to give metrics pipeline time) ---
 
@@ -142,11 +144,6 @@ jobs:
             --require-gpu \
             --image=ko.local:smoke-test
 
-      # --- Cluster Autoscaling validation ---
-
-      - name: Cluster Autoscaling (Karpenter + KWOK)
-        run: bash kwok/scripts/validate-cluster-autoscaling.sh --exercise
-
       # --- Evidence collection ---
 
       - name: Collect AI conformance evidence