test(e0): prove OCM with two scoped spokes

[gnanirahulnutakki]

Summary

• add a reproducible one-hub/two-spoke OCM falsification runner with pinned kind, Kubernetes, addon charts, and archive digests
• prove both reverse tunnels, distinct scoped MSA identities, spoke-local fixture reach, and real-token denials for cluster-wide secrets and nodes
• enforce and actively verify hub-ingress denial while retaining original-direction conntrack evidence
• fail closed on scratch ownership/path races, Docker endpoint/context scope, kind enumeration, and bootstrap invalidation
• replace the incomplete one-spoke evidence with the current ADR, roadmap, runbook, journal, and redacted asciicast

Validation

• make ci — PASS (format, vet, golangci-lint: 0 issues, govulncheck: none, race/unit coverage, 15 shell safety assertions, perf, e2e, build)
• clean retained M0 run from zero — PASS in 151 seconds
• hardened retained verify — PASS for both scoped reaches, both RBAC denials, both active firewall-counter probes, FORWARD policy, and conntrack directionality
• real digest-pinned two-cluster make e2e-kind — PASS under -race in 81.044 seconds
• Bash syntax, ShellCheck, asciicast JSON/redaction, DCO, signed commits, and GSTACK checkpoints — PASS
• cleanup — PASS; zero kind clusters and zero M0 scratch remain

Security review

A complete Codex Security diff scan at pre-fix head 79924565 reviewed all 584 script lines, validated six candidates, applied repository threat-model policy, and sealed with zero reportable product vulnerabilities. Five confirmed harness defects were hardened anyway. Three independent post-fix reviewer lanes then rechecked path lifecycle, credential/Docker lifecycle, and network-evidence integrity; all returned clean.

Residual limitation: clusteradm 1.3.1 requires its short-lived bootstrap value in --hub-token argv. The runner removes long --wait exposure, clears the variable immediately, rotates the ServiceAccount before availability waits, and forces teardown if invalidation cannot be proved.

Caveats retained

• cluster-proxy 0.10.0 CRD/schema skew requires the documented narrow compatibility patch
• the two addon charts require separate namespaces because both own ManagedClusterSetBinding/global
• clusteradm 1.3.1 returns zero for inner kubectl Forbidden output, so the runner validates response text and identity
• single-node kind clusters overlap pod CIDRs; the FORWARD deny is asserted, while direct pod-IP validation remains a non-overlapping-network preproduction check

Refs #2, #3, #4, #5, #6, #39.