test(smoke): add 53-assert discovery cm + secret snapshot

First slice of the ConfigMap snapshot assertion: the discovery
ConfigMap and the operator-managed Secret's key presence. The five
role-group ConfigMap snapshots follow in the next commit.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: maltesander

tests/templates/kuttl/smoke/53-assert.yaml.j2

@@ -0,0 +1,49 @@
+{# vector_enabled gates conditional appender lines added to role-group
+   ConfigMaps when VECTOR_AGGREGATOR is set in the environment. The five
+   role-group ConfigMaps (broker/coordinator/historical/middlemanager/router)
+   are added in a follow-up commit; the flag is declared here for forward
+   reference. #}
+{% set vector_enabled = lookup('env', 'VECTOR_AGGREGATOR') | length > 0 %}
+---
+# Snapshot the full `.data` of each operator-managed ConfigMap.
+# Any code change that alters rendered config values will fail these diffs.
+#
+# Runs as its own step (after 50/51/52) so kuttl does not re-evaluate the heavy
+# heredocs on every 1-second readiness retry of the install step. By this
+# point the cluster is in steady state, so each script runs once.
+#
+# The heredoc is quoted (`<<'YAMLEOF'`) so shell substitution is disabled and
+# Java-properties escapes like `${env\:VAR}` survive verbatim. After the
+# heredoc, `sed` substitutes `__NAMESPACE__` (kuttl namespaces are random per
+# install). For role-group ConfigMaps (added in a follow-up commit) the
+# *actual* side is additionally normalized with `s|/znode-[a-f0-9-]+|/znode-__ZNODE__|`
+# because the zk operator generates a new znode UUID per install. Both sides
+# are then canonicalized to JSON via `yq -o=json`; keys are already
+# alphabetical on both sides (operator stores BTreeMap; kubectl serializes
+# maps sorted; the heredoc is hand-sorted).
+apiVersion: kuttl.dev/v1beta1
+kind: TestAssert
+timeout: 60
+commands:
+  # Operator-managed Secret: verify the data keys exist. Values are random
+  # per install and are not asserted.
+  - script: kubectl -n $NAMESPACE get secret druid-shared-internal-secret -o yaml | yq -e '.data | has("INTERNAL_INITIAL_CLIENT_PASSWORD")'
+  - script: kubectl -n $NAMESPACE get secret druid-shared-internal-secret -o yaml | yq -e '.data | has("OIDC_COOKIE_PASSPHRASE")'
+
+  # Discovery ConfigMap
+  - script: |
+      expected=$(cat <<'YAMLEOF' | sed "s|__NAMESPACE__|$NAMESPACE|g" | yq -o=json
+      DRUID_AVATICA_JDBC: jdbc:avatica:remote:url=http://druid-router.__NAMESPACE__.svc.cluster.local:9088/druid/v2/sql/avatica/
+      DRUID_ROUTER: druid-router.__NAMESPACE__.svc.cluster.local:9088
+      DRUID_SQLALCHEMY: druid://druid-router.__NAMESPACE__.svc.cluster.local:9088/druid/v2/sql
+      YAMLEOF
+      )
+      actual=$(kubectl -n $NAMESPACE get cm druid -o yaml | yq -o=json '.data')
+      if [ "$expected" != "$actual" ]; then
+        echo "ERROR: ConfigMap druid data drifted from snapshot."
+        echo "=== expected ==="
+        printf '%s\n' "$expected"
+        echo "=== actual ==="
+        printf '%s\n' "$actual"
+        exit 1
+      fi