feat(validator): upgrade conformance checks from static to behavioral validation

[dims]

Summary

• Upgrades 5 CNCF AI Conformance v1.34 checks from static/presence validation to behavioral/functional testing, following the self-contained pattern from secure_access_check.go (create resources → wait for behavior → validate → cleanup)
• Each check now proves the validated system actually works, not just that its resources exist

Checks upgraded

Check	What was validated	What is now validated
secure-accelerator-access	DRA pod succeeds with ResourceClaim	+ Negative isolation: pod without claims cannot access GPU devices
robust-controller	Dynamo webhook + CRDs exist	+ Webhook actually rejects invalid DynamoGraphDeployment
inference-gateway	GatewayClass accepted, Gateway programmed, CRDs exist	+ Data-plane readiness: inference-gateway proxy EndpointSlices have ready endpoints
pod-autoscaling	Custom/external metrics APIs have GPU data	+ HPA reads metrics, computes scale-up (desiredReplicas > currentReplicas), Deployment actually scales
cluster-autoscaling	Karpenter deployed, GPU NodePool exists	+ Full chain: HPA → scale → Karpenter provisions KWOK nodes → pods scheduled

Key design decisions

• Autoscaling checks are NOT KWOK-specific — they use external metrics (dcgm_gpu_power_usage) which are cluster-wide, working on any cluster with DCGM + prometheus-adapter
• HPA strict criterion: desiredReplicas > currentReplicas only (not ScalingActive=True which can be true without scale intent)
• Unique per-run namespaces with random suffix prevent cross-run interference from async cleanup
• Namespace cleanup uses context.Background() with bounded timeout so cleanup runs even when parent context is canceled
• Cluster-autoscaling discovers all GPU NodePools and tries each in the behavioral chain (first success wins)
• Removed redundant --exercise steps from CI workflows (behavioral validation now runs inside aicr validate)

Test plan

• All 42 packages pass with -race detector
• New test cases: multi-NodePool discovery, non-gateway EndpointSlice filtering, deployment scale verification, pod scheduling poll loop, namespace cleanup on canceled context
• GPU CI workflows pass end-to-end (inference + training)