Summary

Hydrate healthCheck.assertFile content into
ComponentRef.HealthCheckAsserts during recipe resolution so the
deployment validator can later consume registry-declared Chainsaw asserts.
Add an overlay-driven suppression sentinel as the rollback path.

This PR introduces the mechanism only. The deployment-phase runtime
remains unchanged in this PR — see parent #660 PR 2 for the runner wiring
and image change. The hydrated content is dormant until PR 2 ships the
chainsaw binary.

Scope

• Hydrate healthCheck.assertFile content into
  ComponentRef.HealthCheckAsserts during recipe resolution. Routing
  goes through the DataProvider bound to the Builder / result, so
  per-tenant isolation and external --data overlays continue to work.
• Validator Jobs must continue to consume only the mounted recipe.yaml;
  they must not read registry.yaml at runtime.
• Add a per-recipe suppression sentinel so a leaf overlay can clear
  an inherited hydration (rollback path for a regressing upstream check,
  and the mechanism by which an external --data directory overrides
  registry-declared content). Extend the overlay merge in
  pkg/recipe/metadata.go to honor the sentinel.
• Rewrite the stale // NOTE: healthCheck.assertFile content is intentionally NOT loaded here. block in
  pkg/recipe/metadata.go:199-205 so the comment describes the new
  hydration contract rather than the abandoned reason.
• Make hydration behavior explicit for components disabled via
  overrides.enabled: false — should the hydrated content land in the
  on-disk recipe.yaml artifact or be filtered? Document and test.
• Tests:
  • hydration loads content from registry-declared assertFile
  • suppression sentinel in overlay clears inherited content
  • external --data directory overrides registry-declared content
  • applyRegistryDefaults is idempotent under repeated calls
  • existing pkg/recipe table-driven tests still pass

Out of Scope (lands in later PRs under #660)

• Shipping the chainsaw binary in the deployment validator image (PR 2)
• Relaxing validators/deployment/expected_resources.go:86 (PR 2)
• Read-only assertion allowlist enforcement (PR 2 enforces at runtime,
  PR 5 enforces at lint time)
• Backfilling missing checks (PR 3)
• Enhancing existing checks (PR 4)

Acceptance Criteria

• Recipe resolution hydrates healthCheck.assertFile content onto each
  resolved ComponentRef.HealthCheckAsserts in RecipeResult.
• Hydration routes through the result's bound DataProvider.
• Suppression sentinel in an overlay clears an inherited
  HealthCheckAsserts value.
• The stale NOTE comment in pkg/recipe/metadata.go is rewritten.
• No change to deployment-phase runtime behavior in this PR; the new
  field on disk is dormant content.
• Table-driven tests cover hydration, suppression, and external-data
  override paths.

Related

• Parent epic: [EPIC] Reuse Chainsaw health checks in aicr validate --phase deployment #660
• Closed predecessor: Add registry-driven deployment readiness for all components #622
• ADR: docs: add ADR for shared component checks (deprecated) #631