test(e2e): no suite installs nats, so its tenant trust-anchor leg is unexercised #4702

#3706 called out the nats half of the trust-anchor gap. #4701 covers qdrant, from the sentinel through the CA-extraction controller to tenantsecrets. nats is still untested: no directory under hack/e2e-chainsaw/ installs nats, so since #3340 landed, the nats leg of the tenant CA projection contract (sentinel Ready, a key-free <release>.tenant-ca Secret served through tenantsecrets, the key-bearing Secrets not served) runs in no lane. Fix shape: a nats suite with TLS on, carrying the same two steps #4701 adds for qdrant (anchor published; endpoint trusts only the anchor, with wrong-CA, system-store and plaintext negatives).