Closes #1222. With this merged, epic #660 is fully done.

The PR-time runtime contract from #1219/#1220/#1223 is in place; this
PR closes the depth-of-coverage gap on the 21 health checks that
landed before the epic and were shallow by today's standards. Per the
audit in the PR body, three classes of enhancement:

1. DaemonSet partial-readiness fix (2 files):
   aws-efa, nvidia-dra-driver-gpu were gating on `numberReady > 0`,
   which passed on partial failures. Switched to
   `numberReady == desiredNumberScheduled` with
   `desiredNumberScheduled > 0` as the vacuous-pass guard — same
   pattern that fixed NFD in #1234 and the new gke-nccl-tcpxo in
   #1243.

2. Owned-CRD Established=True assertions (4 components):
   - gpu-operator: clusterpolicies.nvidia.com + the singleton
     `cluster-policy` CR with status.state == "ready". This
     MIGRATES the verifyClusterPolicyReady Go check that PR #1235
     task 7 deferred for assertion-equivalence proof; the static
     Chainsaw assertion is now the canonical readiness signal.
   - dynamo-platform: dynamocomponentdeployments.nvidia.com.
   - nodewright-operator: skyhooks.skyhook.nvidia.com.
   - cert-manager: certificates / issuers / clusterissuers
     .cert-manager.io.
   CRD names verified against
   tests/chainsaw/ai-conformance/cluster/assert-crds.yaml and the
   Go verifyClusterPolicyReady check.

3. cert-manager scope fix:
   Previously asserted only the controller Deployment, missing
   cainjector + webhook. The webhook in particular is load-bearing
   for admission of any Certificate/Issuer CR; a healthy controller
   with a dead webhook would silently pass while the cluster rejects
   every cert-manager CR. Now asserts all three Deployments.

4. Universal container-state error coverage (21 files):
   Every check that previously only gated on pod phase (Pending /
   Failed / Unknown) now also rejects pods stuck in Running phase
   with a known-bad container-waiting reason (CrashLoopBackOff,
   ImagePullBackOff, ErrImagePull, CreateContainerConfigError). The
   phase-only filter missed CrashLoopBackOff entirely because such
   pods typically remain in Running phase with unhealthy
   containers. Same pattern NFD adopted via #1234. Label-scoped in
   shared namespaces (kube-system, monitoring) to avoid sibling
   false-matches; namespace-only otherwise.

Also addresses two post-merge review comments on PR #1244:

- validators/chainsaw/allowlist_test.go: provider prefix changed
  from "." to "" to match the canonical defaultEmbeddedProvider
  used at runtime (head-scratch elimination, no behavior change —
  filepath.Join cleans both forms equivalently).
- Same file: added an explicit CROSS-TEST DEPENDENCY comment block
  noting that empty-assertFile and unreadable-path failure modes
  are owned by pkg/recipe.TestComponentRegistry_RequiresHealthCheck.
  If that test is ever removed or weakened, this test must be
  strengthened in lockstep so a broken registry can't silently
  green-light here.

Out of scope (deferred to follow-up work):

- CRD Established=True for the remaining 6 operators that own CRDs
  but where I lack high-confidence enumeration without pulling the
  charts: gatekeeper, kueue, kubeflow-trainer, network-operator,
  k8s-nim-operator, slinky-slurm-operator. Each needs verification
  against its pinned chart version; bundling them blindly would
  risk introducing typo'd names that fail on live clusters.
  Tracking as a possible follow-up after this PR proves the
  audit-and-enhance pattern works end-to-end.
- StatefulSet readiness for kube-prometheus-stack's Prometheus /
  Alertmanager: similar reasoning — the chart's exact StatefulSet
  names and label conventions need verification.

Allowlist sweep (TestValidateTestReadOnly_RegistryContent) +
registry lint guard (TestComponentRegistry_RequiresHealthCheck)
both pass: 27/27 components valid. Live-cluster validation
deferred to mchmarny per the same agreement as #1235 / #1243.

Refs #660 (epic), #1219, #1220, #1221, #1223, #1234.

Closes #1222. With this merged, epic #660 is fully done.

The PR-time runtime contract from #1219/#1220/#1223 is in place; this
PR closes the depth-of-coverage gap on the 21 health checks that
landed before the epic and were shallow by today's standards. Per the
audit in the PR body, three classes of enhancement:

1. DaemonSet partial-readiness fix (2 files):
   aws-efa, nvidia-dra-driver-gpu were gating on `numberReady > 0`,
   which passed on partial failures. Switched to
   `numberReady == desiredNumberScheduled` with
   `desiredNumberScheduled > 0` as the vacuous-pass guard — same
   pattern that fixed NFD in #1234 and the new gke-nccl-tcpxo in
   #1243.

2. Owned-CRD Established=True assertions (4 components):
   - gpu-operator: clusterpolicies.nvidia.com + the singleton
     `cluster-policy` CR with status.state == "ready". This
     MIGRATES the verifyClusterPolicyReady Go check that PR #1235
     task 7 deferred for assertion-equivalence proof; the static
     Chainsaw assertion is now the canonical readiness signal.
   - dynamo-platform: dynamocomponentdeployments.nvidia.com.
   - nodewright-operator: skyhooks.skyhook.nvidia.com.
   - cert-manager: certificates / issuers / clusterissuers
     .cert-manager.io.
   CRD names verified against
   tests/chainsaw/ai-conformance/cluster/assert-crds.yaml and the
   Go verifyClusterPolicyReady check.

3. cert-manager scope fix:
   Previously asserted only the controller Deployment, missing
   cainjector + webhook. The webhook in particular is load-bearing
   for admission of any Certificate/Issuer CR; a healthy controller
   with a dead webhook would silently pass while the cluster rejects
   every cert-manager CR. Now asserts all three Deployments.

4. Universal container-state error coverage (21 files):
   Every check that previously only gated on pod phase (Pending /
   Failed / Unknown) now also rejects pods stuck in Running phase
   with a known-bad container-waiting reason (CrashLoopBackOff,
   ImagePullBackOff, ErrImagePull, CreateContainerConfigError). The
   phase-only filter missed CrashLoopBackOff entirely because such
   pods typically remain in Running phase with unhealthy
   containers. Same pattern NFD adopted via #1234. Label-scoped in
   shared namespaces (kube-system, monitoring) to avoid sibling
   false-matches; namespace-only otherwise.

Also addresses two post-merge review comments on PR #1244:

- validators/chainsaw/allowlist_test.go: provider prefix changed
  from "." to "" to match the canonical defaultEmbeddedProvider
  used at runtime (head-scratch elimination, no behavior change —
  filepath.Join cleans both forms equivalently).
- Same file: added an explicit CROSS-TEST DEPENDENCY comment block
  noting that empty-assertFile and unreadable-path failure modes
  are owned by pkg/recipe.TestComponentRegistry_RequiresHealthCheck.
  If that test is ever removed or weakened, this test must be
  strengthened in lockstep so a broken registry can't silently
  green-light here.

Out of scope (deferred to follow-up work):

- CRD Established=True for the remaining 6 operators that own CRDs
  but where I lack high-confidence enumeration without pulling the
  charts: gatekeeper, kueue, kubeflow-trainer, network-operator,
  k8s-nim-operator, slinky-slurm-operator. Each needs verification
  against its pinned chart version; bundling them blindly would
  risk introducing typo'd names that fail on live clusters.
  Tracking as a possible follow-up after this PR proves the
  audit-and-enhance pattern works end-to-end.
- StatefulSet readiness for kube-prometheus-stack's Prometheus /
  Alertmanager: similar reasoning — the chart's exact StatefulSet
  names and label conventions need verification.

Allowlist sweep (TestValidateTestReadOnly_RegistryContent) +
registry lint guard (TestComponentRegistry_RequiresHealthCheck)
both pass: 27/27 components valid. Live-cluster validation
deferred to mchmarny per the same agreement as #1235 / #1243.

Refs #660 (epic), #1219, #1220, #1221, #1223, #1234.

Deployment-phase health-check validation regressed in the recent
in-process executor + deepened-check stack (NVIDIA#1235/NVIDIA#1245/NVIDIA#1252):

1. inprocess.go: runAssertWithRetry/runErrorWithRetry retried ANY
   non-nil error, so a permanent JMESPath evaluation error was retried
   for the entire assert window (6m) instead of failing fast like the
   old chainsaw binary did. Classify assertion-engine errors as
   ErrCodeInvalidRequest (terminal) and short-circuit the retry loops
   on them. Adds a regression test asserting terminal eval errors
   fail fast (< AssertRetryInterval) rather than retrying to deadline.

2. recipes/checks/*: the (init)containerStatuses[?...] | length(@)
   projection throws 'invalid type for: <nil>' on any pod without
   (init) containers (the common case), feeding defect #1. Coalesce to
   an empty array across all 22 affected component health checks.

3. recipes/checks/dynamo-platform: validate-deployment-exists asserted
   a Deployment named 'dynamo-operator', but the chart prefixes it with
   the release name (dynamo-platform-dynamo-operator-controller-manager),
   so the assert never matched and retried to the deadline. Match by the
   stable app.kubernetes.io/name=dynamo-operator label instead.

Verified on an EKS H100 cluster: deployment phase goes from an 8m
timeout (status=other) to PASSED in ~21s; full deployment 4/4 and
conformance 11/11 green.

Deployment-phase health-check validation regressed in the recent
in-process executor + deepened-check stack (NVIDIA#1235/NVIDIA#1245/NVIDIA#1252):

1. inprocess.go: runAssertWithRetry/runErrorWithRetry retried ANY
   non-nil error, so a permanent JMESPath evaluation error was retried
   for the entire assert window (6m) instead of failing fast like the
   old chainsaw binary did. Classify assertion-engine errors as
   ErrCodeInvalidRequest (terminal) and short-circuit the retry loops
   on them. Adds a regression test asserting terminal eval errors
   fail fast (< AssertRetryInterval) rather than retrying to deadline.

2. recipes/checks/*: the (init)containerStatuses[?...] | length(@)
   projection throws 'invalid type for: <nil>' on any pod without
   (init) containers (the common case), feeding defect #1. Coalesce to
   an empty array across all 22 affected component health checks.

3. recipes/checks/dynamo-platform: validate-deployment-exists asserted
   a Deployment named 'dynamo-operator', but the chart prefixes it with
   the release name (dynamo-platform-dynamo-operator-controller-manager),
   so the assert never matched and retried to the deadline. Match by the
   stable app.kubernetes.io/name=dynamo-operator label instead.

Verified on an EKS H100 cluster: deployment phase goes from an 8m
timeout (status=other) to PASSED in ~21s; full deployment 4/4 and
conformance 11/11 green.

Deployment-phase health-check validation regressed in the recent
in-process executor + deepened-check stack (NVIDIA#1235/NVIDIA#1245/NVIDIA#1252):

1. inprocess.go: runAssertWithRetry/runErrorWithRetry retried ANY
   non-nil error, so a permanent JMESPath evaluation error was retried
   for the entire assert window (6m) instead of failing fast like the
   old chainsaw binary did. Classify assertion-engine errors as
   ErrCodeInvalidRequest (terminal) and short-circuit the retry loops
   on them. Adds a regression test asserting terminal eval errors
   fail fast (< AssertRetryInterval) rather than retrying to deadline.

2. recipes/checks/*: the (init)containerStatuses[?...] | length(@)
   projection throws 'invalid type for: <nil>' on any pod without
   (init) containers (the common case), feeding defect #1. Coalesce to
   an empty array across all 22 affected component health checks.

3. recipes/checks/dynamo-platform: validate-deployment-exists asserted
   a Deployment named 'dynamo-operator', but the chart prefixes it with
   the release name (dynamo-platform-dynamo-operator-controller-manager),
   so the assert never matched and retried to the deadline. Match by the
   stable app.kubernetes.io/name=dynamo-operator label instead.

Verified on an EKS H100 cluster: deployment phase goes from an 8m
timeout (status=other) to PASSED in ~21s; full deployment 4/4 and
conformance 11/11 green.

Deployment-phase health-check validation regressed in the recent
in-process executor + deepened-check stack (NVIDIA#1235/NVIDIA#1245/NVIDIA#1252):

1. inprocess.go: runAssertWithRetry/runErrorWithRetry retried ANY
   non-nil error, so a permanent JMESPath evaluation error was retried
   for the entire assert window (6m) instead of failing fast like the
   old chainsaw binary did. Classify assertion-engine errors as
   ErrCodeInvalidRequest (terminal) and short-circuit the retry loops
   on them. Adds a regression test asserting terminal eval errors
   fail fast (< AssertRetryInterval) rather than retrying to deadline.

2. recipes/checks/*: the (init)containerStatuses[?...] | length(@)
   projection throws 'invalid type for: <nil>' on any pod without
   (init) containers (the common case), feeding defect #1. Coalesce to
   an empty array across all 22 affected component health checks.

3. recipes/checks/dynamo-platform: validate-deployment-exists asserted
   a Deployment named 'dynamo-operator', but the chart prefixes it with
   the release name (dynamo-platform-dynamo-operator-controller-manager),
   so the assert never matched and retried to the deadline. Match by the
   stable app.kubernetes.io/name=dynamo-operator label instead.

Verified on an EKS H100 cluster: deployment phase goes from an 8m
timeout (status=other) to PASSED in ~21s; full deployment 4/4 and
conformance 11/11 green.

Deployment-phase health-check validation regressed in the recent
in-process executor + deepened-check stack (NVIDIA#1235/NVIDIA#1245/NVIDIA#1252):

1. inprocess.go: runAssertWithRetry/runErrorWithRetry retried ANY
   non-nil error, so a permanent JMESPath evaluation error was retried
   for the entire assert window (6m) instead of failing fast like the
   old chainsaw binary did. Classify assertion-engine errors as
   ErrCodeInvalidRequest (terminal) and short-circuit the retry loops
   on them. Adds a regression test asserting terminal eval errors
   fail fast (< AssertRetryInterval) rather than retrying to deadline.

2. recipes/checks/*: the (init)containerStatuses[?...] | length(@)
   projection throws 'invalid type for: <nil>' on any pod without
   (init) containers (the common case), feeding defect #1. Coalesce to
   an empty array across all 22 affected component health checks.

3. recipes/checks/dynamo-platform: validate-deployment-exists asserted
   a Deployment named 'dynamo-operator', but the chart prefixes it with
   the release name (dynamo-platform-dynamo-operator-controller-manager),
   so the assert never matched and retried to the deadline. Match by the
   stable app.kubernetes.io/name=dynamo-operator label instead.

Verified on an EKS H100 cluster: deployment phase goes from an 8m
timeout (status=other) to PASSED in ~21s; full deployment 4/4 and
conformance 11/11 green.