ci: actually run conformance suite (export KUBECONFIG to kind)

[stubbi]

Summary

The conformance suite's specs all silently SKIP in CI: helm/kind-action writes the kubeconfig to $HOME/.kube/config but never exports KUBECONFIG, and the suite's BeforeSuite skips the whole run when KUBECONFIG is unset (run 27262377802 reported Ran 0 of 39 Specs ... 39 Skipped while still going green). This exports KUBECONFIG in the workflow and hardens BeforeSuite, then fixes the real failures that were masked by the silent skip so the suite actually executes and passes.

Root-cause fix

• .github/workflows/conformance.yaml: after each helm/kind-action step, export KUBECONFIG=$HOME/.kube/config to $GITHUB_ENV (4 kind-using jobs).
• test/conformance/conformance_suite_test.go: BeforeSuite now resolves the kubeconfig via clientcmdPath() — the same $KUBECONFIG-or-~/.kube/config fallback the rest of the suite already uses — and only skips when no kubeconfig file exists. Defense-in-depth so a reachable cluster is never silently ignored again.

Pre-existing bugs surfaced once the suite ran (all masked by the silent skip)

• Makefile: conformance-negative focused on "negative", which matches no spec text (webhook deny paths / deny: ...), so the job ran 0 specs. Fixed the focus to "webhook deny paths".
• negative_test.go: the deny-path assertion checked err.Error() (only the process exit status, "exit status 1") instead of the kubectl output that carries the webhook denial message. Now asserts against the output. All 19 webhook-deny specs pass.
• testdata/*.yaml: fixtures pinned image tag v1.0.0 / 1.0.0, which was never published to ghcr.io/paperclipinc/hermes-agent (only v2026.5.29.2 and latest exist) → ImagePullBackOff. Pinned to the real published tag v2026.5.29.2.

Left skipped (visibly, with reasons) — out of scope for this CI fix

• The idempotency corpus becomes Ready specs are blocked by operator: init-uv copies from /opt/venv-template (absent in published hermes-agent image) so no HermesInstance reaches Ready #68: the operator's init-uv container copies pyproject.toml/uv.lock from /opt/venv-template/, which the published hermes-agent image does not ship (its venv is at /opt/venv), so no HermesInstance reaches Ready. Filed as operator: init-uv copies from /opt/venv-template (absent in published hermes-agent image) so no HermesInstance reaches Ready #68; specs Skip with a reason pointing there rather than hanging until timeout.
• ollama-webterminal-tailscale additionally needs a real ephemeral tailnet auth key (the fixture ships a dummy key).

Local verification

kind v1.31 cluster + cert-manager + operator installed, suite run with KUBECONFIG set:

[BeforeSuite] PASSED
Ran 19 of 39 Specs in 3.745 seconds
SUCCESS! -- 19 Passed | 0 Failed | 0 Pending | 20 Skipped

(vs the original Ran 0 of 39 ... 39 Skipped.) The 19 webhook-deny specs execute and pass; the 20 idempotency specs skip with documented reasons.

Test plan

• Lint passes (make lint)
• Tests pass (make test)
• Reconcile-guard passes (bash hack/reconcile-guard.sh)
• Helm RBAC sync passes (bash hack/check-helm-rbac.sh)
• For CRD/API changes: make manifests + make generate regenerated — n/a (no API changes)
• For RBAC changes: make sync-bundle-rbac if the bundle is affected — n/a
• For behavior changes: conformance suite now executes against the kind cluster (verified locally; 19 webhook-deny specs pass, idempotency specs skip with reasons)

Related issues

Closes #64
Refs #68 (init-uv /opt/venv-template image-contract bug that blocks idempotency Ready-gating)