Post-1.0 finale: Calico-enforced egress denial + visual-regression lock

- scripts/netpol-cluster.sh: a kind cluster with Calico (default CNI
  disabled) — the only way to PROVE the §15 default-deny NetworkPolicy,
  since kindnet accepts the object but never enforces it. New live test
  on that cluster: outbound connect to 1.1.1.1 dropped, DNS egress
  dropped, while API-server exec keeps working (not pod network).
  Kernel-level enforcement of the sandbox egress claim, demonstrated
- K8sDriver::connect_with_context: pin a kubeconfig context instead of
  ambient. The whole k8s suite now pins its cluster explicitly — the
  netpol cluster's creation had silently switched the current context
  and stranded the seccomp test on the wrong cluster (fixed and made
  impossible to recur)
- CI: netpol-cluster up + calico egress test in the sandbox-k8s job
- Visual-regression lock (plan P6): @visual Playwright spec with
  animation-disabled, masked-dynamic-region screenshots of login,
  workspace home, chat welcome, computer panel, credits; darwin
  baselines committed (5 PNGs); CI excludes @visual until linux
  baselines are generated there. Full local suite: 33 journeys

165 Rust tests + 5 live kind tests (2 clusters) + 33 journeys.

Co-Authored-By: Claude Fable 5 <[email protected]>

crates/cm-sandbox/src/k8s.rs

@@ -42,6 +42,28 @@ impl K8sDriver {
         // are linked; first caller wins, repeats are harmless.
         let _ = rustls::crypto::ring::default_provider().install_default();
         let client = kube::Client::try_default().await.map_err(engine_err)?;
+        K8sDriver::with_client(client, namespace).await
+    }
+
+    /// Connects to a SPECIFIC kubeconfig context (e.g. the
+    /// NetworkPolicy-enforcing test cluster) instead of the current one.
+    pub async fn connect_with_context(
+        namespace: &str,
+        context: &str,
+    ) -> Result<K8sDriver, SandboxError> {
+        let _ = rustls::crypto::ring::default_provider().install_default();
+        let options = kube::config::KubeConfigOptions {
+            context: Some(context.to_owned()),
+            ..Default::default()
+        };
+        let config = kube::Config::from_kubeconfig(&options)
+            .await
+            .map_err(engine_err)?;
+        let client = kube::Client::try_from(config).map_err(engine_err)?;
+        K8sDriver::with_client(client, namespace).await
+    }
+
+    async fn with_client(client: kube::Client, namespace: &str) -> Result<K8sDriver, SandboxError> {
         let driver = K8sDriver {
             client,
             namespace: namespace.to_owned(),