Add OpenShift Tests Extension (OTE) for baremetal E2E tests

Implements OTE framework to migrate baremetal E2E tests from
openshift-tests-private to cluster-baremetal-operator repository.

Changes:
- Add cmd/cluster-baremetal-tests-ext/main.go: OTE binary entry point
  that registers as openshift:payload:cluster-baremetal extension
- Add test/e2e/baremetal/deployment_sanity.go: 6 migrated baremetal tests
  * Cluster operators running check (OCP-29146)
  * Nodes running check (OCP-29147)
  * Deployment availability check (OCP-29148)
  * Worker node validation (OCP-29149)
  * CPU usage check (OCP-29150)
  * Memory check (OCP-29151)
- Add test/e2e/baremetal/utils.go: Helper functions using compat_otp
- Update go.mod/go.sum: Add OTE dependencies and OpenShift kubernetes replaces
- Update Makefile: Add build-tests target with -mod=mod approach

Build system:
- Main CBO builds continue using vendor/ (no changes to existing workflow)
- OTE build uses -mod=mod flag to download deps to Go module cache
- GONOSUMDB bypasses checksum verification for origin pseudo-versions
- CGO_ENABLED=0 produces static binary for container compatibility
- GO_COMPLIANCE_POLICY="exempt_all" exempts test binaries from internal checks

Tests use platform=="baremetal" selector and run under origin CI.
Binary: cluster-baremetal-tests-ext (payload test extension)

Fixes from code review:
- Updated kubernetes dependencies to latest commit (73359c58edaa)
- Added comprehensive build flag documentation in Makefile
- Fixed topology-aware replica sizing (SNO/HighlyAvailable/External)
- Fixed malformed jsonpath in deployment status check
- Fixed Prometheus memory parsing to use ParseFloat instead of Atoi
- Fixed defer Close() placement to prevent nil pointer panics
- Fixed swapped iLO6 firmware URLs
- Removed shell injection vulnerabilities in certificate parsing
- Lowered go version to 1.25.5 for CI compatibility

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

Author: jadhaj

Makefile

@@ -10,9 +10,9 @@ CONTAINER_TOOL ?= docker
 # Image URL to use all building/pushing image targets
 IMG ?= controller:latest
 
-CONTROLLER_GEN ?= go run vendor/sigs.k8s.io/controller-tools/cmd/controller-gen/main.go
+CONTROLLER_GEN ?= go run sigs.k8s.io/controller-tools/cmd/controller-gen
 CRD_OPTIONS="crd:crdVersions=v1"
-GOLANGCI_LINT ?= GOLANGCI_LINT_CACHE=$(GOLANGCI_LINT_CACHE) go run vendor/github.com/golangci/golangci-lint/v2/cmd/golangci-lint/main.go
+GOLANGCI_LINT ?= GOLANGCI_LINT_CACHE=$(GOLANGCI_LINT_CACHE) go run github.com/golangci/golangci-lint/v2/cmd/golangci-lint
 KUSTOMIZE ?= go run sigs.k8s.io/kustomize/kustomize/v4
 MANIFEST_PROFILE ?= default
 TMP_DIR := $(shell mktemp -d -t manifests-$(date +%Y-%m-%d-%H-%M-%S)-XXXXXXXXXX)
@@ -35,6 +35,18 @@ test: generate lint manifests unit
 build:
 	go build -o bin/cluster-baremetal-operator main.go
 
+# Build OTE test extension binary
+# GONOSUMDB bypasses checksum verification for origin module - required because origin uses pseudo-versions not in public checksum database
+# CGO_ENABLED=0 produces static binary for container compatibility
+# GO_COMPLIANCE_POLICY="exempt_all" is OpenShift-specific variable that exempts test binaries from internal compliance checks
+#   - Used consistently across OpenShift test extensions (see openshift-tests, oc-tests-ext, etc.)
+#   - Blanket exemption is standard for test-only binaries that don't ship to customers
+#   - Test extensions run in CI environments only, not in production clusters
+build-tests:
+	GONOSUMDB="github.com/openshift/origin" CGO_ENABLED=0 GO_COMPLIANCE_POLICY="exempt_all" \
+	go build -mod=mod -o bin/cluster-baremetal-tests-ext ./cmd/cluster-baremetal-tests-ext
+	gzip -f bin/cluster-baremetal-tests-ext
+
 # Run against the configured Kubernetes cluster in ~/.kube/config
 run: generate manifests
 	go run ./main.go -images-json $(IMAGES_JSON)

cmd/cluster-baremetal-tests-ext/main.go

@@ -0,0 +1,62 @@
+package main
+
+import (
+	"fmt"
+	"os"
+
+	"github.com/spf13/cobra"
+	extcmd "github.com/openshift-eng/openshift-tests-extension/pkg/cmd"
+	e "github.com/openshift-eng/openshift-tests-extension/pkg/extension"
+	et "github.com/openshift-eng/openshift-tests-extension/pkg/extension/extensiontests"
+	g "github.com/openshift-eng/openshift-tests-extension/pkg/ginkgo"
+
+	// Import test packages to register Ginkgo specs
+	_ "github.com/openshift/cluster-baremetal-operator/test/e2e/baremetal"
+)
+
+func main() {
+	// Extension registry
+	registry := e.NewRegistry()
+
+	// Create extension
+	ext := e.NewExtension(
+		"openshift",           // product
+		"payload",             // type
+		"cluster-baremetal",   // component name
+	)
+
+	// Add suites to the extension
+	ext.AddSuite(e.Suite{
+		Name:    "cluster-baremetal/all",
+		Parents: []string{"openshift/conformance/parallel"},
+	})
+
+	// Build test specs from Ginkgo tests automatically
+	specs, err := g.BuildExtensionTestSpecsFromOpenShiftGinkgoSuite()
+	if err != nil {
+		panic(fmt.Sprintf("couldn't build extension test specs from ginkgo: %+v", err.Error()))
+	}
+
+	// Apply environment selectors - baremetal platform only
+	// All tests should only run on baremetal platform
+	specs.Select(et.NameContains("")).
+		Include(et.PlatformEquals("baremetal"))
+
+	// Add specs to extension
+	ext.AddSpecs(specs)
+	registry.Register(ext)
+
+	// Create root command
+	rootCmd := &cobra.Command{
+		Use:   "cluster-baremetal-tests-ext",
+		Short: "Cluster BareMetal Operator Test Extension",
+		Long:  "OpenShift Tests Extension for Cluster BareMetal Operator E2E Tests",
+	}
+
+	// Register OTE subcommands (info, list, run-test, run-suite, etc.)
+	rootCmd.AddCommand(extcmd.DefaultExtensionCommands(registry)...)
+
+	if err := rootCmd.Execute(); err != nil {
+		os.Exit(1)
+	}
+}