refactor(e2e): extract shared kat-server backends

[ppeble]

Description

Every fixture under test/e2e/fixtures/ was carrying its own copy of the same handful of kat-server Deployment+Service shapes, which accounted for most of the duplication across the suite's manifests.yaml files.

This adds test/e2e/backends/ with one file per distinct shape and repoints fixtures at it with an extra apply step. Chainsaw resolves apply.file relative to the directory containing the chainsaw-test.yaml that references it rather than the process working directory, so a relative path can climb out of fixtures/<name>/ into backends/ and the resources still land in that test's own ephemeral namespace.

No intended change in coverage. This is groundwork: roughly 11 more fixtures are queued behind it, and without this each one would carry another ~40 lines of copied backend YAML.

Shapes added

File	Name	Used by
backends/http-echo.yaml	http-echo	http-basic, gzip-content-type, gzip-minimum, server-name
backends/target.yaml	target	extauth-http, ratelimit-grpc
backends/grpc-echo.yaml	grpc-echo	grpc-basic
backends/rls.yaml	rls	ratelimit-grpc

Each fixture keeps its own CRDs (Mapping, Module, AuthService, RateLimitService, and so on) in its own manifests.yaml. Only the backend Deployment+Service moves out.

What deliberately stayed inline

A shared file's Deployment and Service use a fixed metadata.name, because apply has no equivalent of a helm value to parameterize it per fixture. A fixture can therefore only pull in a shared backend if its probe either does not assert on .json.backend or asserts exactly the name the shared file uses.

Three fixtures keep their backends inline for that reason:

• header-routing needs two distinctly-named backends of the same shape at once (hr-target1, hr-target2).
• gzip-unsupported-content-type asserts gzip-unsup-echo, a name only it uses.
• tcpmapping-basic asserts tcp-echo, likewise.

Extracting those would move the duplication rather than remove it.

Line counts

	before	after
fixtures/*/manifests.yaml	835	514
backends/	0	164
whole test/e2e/	2184	2089

The tree shrinks by 95 lines despite four new files and a new README section.

Testing

Ran locally against a k3d cluster, per fixture and then all together:

• Converted: http-basic, gzip-content-type, gzip-minimum, server-name, grpc-basic, extauth-http, ratelimit-grpc. All pass.
• Untouched controls: header-routing, tcpmapping-basic, gzip-unsupported-content-type. All pass.
• Full sharded make e2e/run: all 10 fixtures pass together.

Checklist

• test/e2e/README.md documents backends/, when a fixture can use it, and when it cannot
• No change to fixture coverage or assertions

[cocogitto-bot]

✔️ e1eabc1 - Conventional commits check succeeded.

[ppeble]

Closing this. Not pursuing the shared-backend refactor right now; the duplication it removes is not blocking anything. The Chainsaw behaviour it established is worth recording for anyone who picks this up later: apply.file resolves relative to the directory containing the chainsaw-test.yaml, not the process working directory, so a fixture can reach a shared file outside its own directory and the resources still land in that test's ephemeral namespace.