test(e2e): add CLI conformance baseline

[elezar]

Summary

Establish a portable CLI conformance baseline by selecting existing E2E workflows rather than duplicating their implementations. Driver lanes enable the same profile where those workflows already run, while VM-only filesystem assertions remain driver-specific.

This is stack 1/2. PR #2873 adds the direct API conformance framework on top.

Related Issue

• spike: driver conformance suite for compute drivers #2183
• Follow-up: test(e2e): add API conformance framework #2873
• Prototype/reference: test(e2e): add API and CLI conformance profiles #2182

Changes

• add the e2e-cli-conformance profile and focused mise run e2e:cli-conformance task
• classify smoke, sandbox_lifecycle, and sandbox_labels as portable CLI conformance targets
• enable the profile in Docker, Podman, Kubernetes, and VM wrappers where those targets already run
• keep the canonical Docker E2E task running the promoted targets
• extract VM overlay and TLS-key permission assertions into the VM-specific vm_overlay target
• document the portable and driver-specific test boundary

Testing

• locked compilation of smoke, lifecycle, labels, and VM overlay targets
• Rust formatting checks
• shell syntax checks for modified E2E wrappers
• git diff --check
• live driver-backed CLI conformance runs
• mise run pre-commit (mise is unavailable in the current environment)

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)
• Portable test implementations are reused rather than duplicated
• Driver-specific VM assertions remain outside conformance
• Documentation updated

[copy-pr-bot]

Auto-sync is disabled for draft pull requests in this repository. Workflows must be run manually.

Contributors can view more details about this message here.

[github-actions]

Label test:e2e applied, but pull-request/2871 does not exist yet. A maintainer needs to comment /ok to test 4180d62b99b1e3d9891f8281cd0a1adb2e10ac3b to mirror this PR. Once the mirror exists, re-apply the label or re-run Branch E2E Checks from the Actions tab.