test: migrate workload-derives-deployment from infra

Migrate the Workload-derives-WorkloadDeployment contract test out of
datum-cloud/infra into the owning repo, per datum-cloud/infra#3006. That issue
consolidates infra's live-env Chainsaw suite into one "construct" group and
evacuates single-service compute.datumapis.com contract tests to compute, run
against the local kind harness pre-merge.

This test applies a Workload and asserts the control plane accepts it, then
waits for the derived WorkloadDeployment (<name>-central) to reach
Progressing=true and asserts it — control-plane derivation only, no wait for
VMs to become Available.

Key changes:
- Add test/e2e/workload-derives-deployment/ with the chainsaw test and the
  location.yaml / network.yaml / workload.yaml fixtures copied from infra.
- Drop the datumctl auth update-kubeconfig setup step and the project
  control-plane cluster block; target a local kind cluster via spec.cluster,
  mirroring datum-cloud/network-services-operator.
- Remove spec.skip: true.

Depends on the chainsaw harness introduced in the workload-api-acceptance
migration PR (Makefile kind + chainsaw tooling and the test-chainsaw target).

Author: ecv

test/e2e/workload-derives-deployment/chainsaw-test.yaml

@@ -0,0 +1,43 @@
+# yaml-language-server: $schema=https://raw.githubusercontent.com/kyverno/chainsaw/main/.schemas/json/test-chainsaw-v1alpha1.json
+apiVersion: chainsaw.kyverno.io/v1alpha1
+kind: Test
+metadata:
+  name: workload-derives-deployment
+spec:
+  cluster: compute-e2e
+  steps:
+    - name: Apply Workload and fixtures
+      try:
+        - apply:
+            timeout: 1m
+            file: location.yaml
+        - apply:
+            timeout: 1m
+            file: network.yaml
+        - apply:
+            timeout: 1m
+            file: workload.yaml
+        - assert:
+            resource:
+              apiVersion: compute.datumapis.com/v1alpha
+              kind: Workload
+              metadata:
+                name: e2e-derived-workload
+
+    - name: Assert WorkloadDeployment is derived per placement
+      try:
+        - wait:
+            apiVersion: compute.datumapis.com/v1alpha
+            kind: WorkloadDeployment
+            name: e2e-derived-workload-central
+            timeout: 3m
+            for:
+              condition:
+                name: Progressing
+                value: 'true'
+        - assert:
+            resource:
+              apiVersion: compute.datumapis.com/v1alpha
+              kind: WorkloadDeployment
+              metadata:
+                name: e2e-derived-workload-central

test/e2e/workload-derives-deployment/location.yaml

@@ -0,0 +1,12 @@
+apiVersion: networking.datumapis.com/v1alpha
+kind: Location
+metadata:
+  name: us-central1-a
+  labels:
+    topology.datum.net/city-code: ORD
+spec:
+  provider:
+    gcp:
+      projectId: datum-cloud-staging
+      region: us-central1
+      zone: us-central1-a

test/e2e/workload-derives-deployment/network.yaml

@@ -0,0 +1,8 @@
+apiVersion: networking.datumapis.com/v1alpha
+kind: Network
+metadata:
+  name: e2e-derived-network
+  namespace: default
+spec:
+  ipam:
+    mode: Auto

test/e2e/workload-derives-deployment/workload.yaml

@@ -0,0 +1,34 @@
+apiVersion: compute.datumapis.com/v1alpha
+kind: Workload
+metadata:
+  name: e2e-derived-workload
+  namespace: default
+spec:
+  template:
+    spec:
+      runtime:
+        resources:
+          instanceType: datumcloud/d1-standard-2
+        sandbox:
+          containers:
+            - name: httpbin
+              image: kennethreitz/httpbin
+              ports:
+                - name: http
+                  port: 80
+      networkInterfaces:
+        - network:
+            name: e2e-derived-network
+          networkPolicy:
+            ingress:
+              - ports:
+                  - port: 80
+                from:
+                  - ipBlock:
+                      cidr: 0.0.0.0/0
+  placements:
+    - name: central
+      cityCodes:
+        - ORD
+      scaleSettings:
+        minReplicas: 1