test(bdd): add shared PKI observability DSL

[sbaum1994]

Description

The PKI test-escape features under #1292 repeat substantial shell mechanics for negative command results, TLS WatchStargates observation, and Pylon connection metrics. The repetition makes the features harder to read and maintain even though the operator-visible targets and expectations are the same.

Add shared strict-DSL primitives that keep every meaningful command target, TLS identity, Kubernetes context, timeout, metric, comparison, and expected value visible while hiding only command construction, polling, and output-format parsing.

Scope

• Add generic assertions for a non-zero command result and for output containing one or all expected diagnostics.
• Add a TLS WatchStargates command adapter with explicit endpoint, authority, CA secret, namespace, Kubernetes context, and observation duration.
• Add a Pylon metrics observable with an explicit pod container selector, Kubernetes context, timeout, metric name, comparison, and expected connected-series count.
• Preserve the real command result and command logs for outside-in debugging.
• Document the shared vocabulary in tests/bdd/PLAN.md.
• Add unit coverage for table validation, command construction, result handling, interpolation, and failure behavior.
• Rebase and refactor test(bdd): cover secure and fail-closed Pylon registration #1308, test(bdd): cover fail-closed Pylon TLS registration #1309, and test(bdd): cover secure multi-region Pylon registration #1310 to consume the shared DSL.

Definition of Done

• The new steps follow the strict-DSL layering contract and do not hide profile export, cluster registration, stack installation, or function lifecycle actions.
• Negative scenarios run the actual failing command and assert its non-zero result directly instead of converting rejection into shell success markers.
• Positive WatchStargates observation requires a streamed snapshot before accepting the expected client deadline.
• Pylon connection expectations remain fully visible in Gherkin.
• go test -short ./... and golangci-lint run --config .golangci.yml ./... pass from tests/bdd.
• test(bdd): cover secure and fail-closed Pylon registration #1308, test(bdd): cover fail-closed Pylon TLS registration #1309, and test(bdd): cover secure multi-region Pylon registration #1310 are rebased onto the shared implementation and their non-live wiring tests pass.

Parent and related work

• Parent: epic(llm-router): secure and reliable Pylon registration across clusters #1292
• Related feature tasks: test(bdd): cover secure multi-cluster Pylon registration #1305, test(bdd): cover fail-closed Pylon TLS registration #1306, test(bdd): cover secure multi-region Pylon registration #1307
• Related Pull Requests: test(bdd): cover secure and fail-closed Pylon registration #1308, test(bdd): cover fail-closed Pylon TLS registration #1309, test(bdd): cover secure multi-region Pylon registration #1310

---

By submitting this issue, you acknowledge that you are an assigned member of the NVCF development team and agree to follow the project code of conduct and contributing guidelines.