Summary

Audit and enhance the existing 19 Chainsaw health checks under
recipes/checks/* so they are deep enough to serve as post-install
readiness, not just existence checks.

Depends on #660 PR 1 + PR 2. Best landed after #660 PR 3 (backfill) so
all 22 components are covered before the audit.

Scope

For each existing check, audit and enhance where the current assertion
is too shallow. Targets include (non-exhaustive):

• Workload-level readiness: verify
  Deployment.availableReplicas >= desired,
  StatefulSet.readyReplicas >= desired,
  DaemonSet (desiredNumberScheduled > 0 and
  numberReady == desiredNumberScheduled) where checks currently only
  assert object existence.
• CRD Established=True: verify the condition where the component
  owns CRDs.
• Selector tightening in shared namespaces: in kube-system,
  monitoring, and other shared namespaces, tighten label selectors so
  checks don't false-match sibling components.
• Component-specific readiness: add or strengthen custom assertions
  the component genuinely requires
  (e.g., ClusterPolicy.status.state == "ready", Skyhook customization
  completion, DRA kubelet-plugin readiness).

Constraints

• Read-only assert / error allowlist only — no script, wait,
  catch, apply, create, delete, patch, update, ... (per
  [EPIC] Reuse Chainsaw health checks in aicr validate --phase deployment #660 PR 2 enforcement).
• Deployer-neutral: no release-scoped labels
  (app.kubernetes.io/instance), no Helm API calls, no
  release-metadata reads.

Acceptance Criteria

• Per-component audit summary in the PR description identifying which
  checks were shallow and what was strengthened.
• Workload-level readiness assertions added where missing.
• CRD Established=True assertions added where the component owns
  CRDs.
• Shared-namespace selectors are tight enough to avoid sibling-component
  false matches.
• Live-cluster validation run against
  h100-eks-ubuntu-inference-dynamo confirms every enhanced check
  passes; unexercised mapped components (e.g., aws-efa,
  network-operator, gke-nccl-tcpxo, kubeflow-trainer) documented.

Related

• Parent epic: [EPIC] Reuse Chainsaw health checks in aicr validate --phase deployment #660
• Depends on: [EPIC] Reuse Chainsaw health checks in aicr validate --phase deployment #660 PR 1, [EPIC] Reuse Chainsaw health checks in aicr validate --phase deployment #660 PR 2; best after [EPIC] Reuse Chainsaw health checks in aicr validate --phase deployment #660 PR 3