Backfill CRD Established=True for 6 operator-owning health checks #1246

Summary

Follow-up to PR #1245 (closed #1222, closed epic #660). Add
Established=True assertions for the CRDs owned by 6 operator
components that PR #1245 deferred because each needs chart-version
verification.

Background

PR #1245 added CRD Established=True assertions for 4 operator-owning
components where the CRD names were verifiable from in-tree sources
(tests/chainsaw/ai-conformance/cluster/assert-crds.yaml and the Go
verifyClusterPolicyReady check):

• gpu-operator → clusterpolicies.nvidia.com
• dynamo-platform → dynamocomponentdeployments.nvidia.com
• nodewright-operator → skyhooks.skyhook.nvidia.com
• cert-manager → certificates.cert-manager.io,
  issuers.cert-manager.io, clusterissuers.cert-manager.io

Six operators that own CRDs were left out because their CRD lists
aren't enumerated in-tree at the pinned chart version. Bundling them
blindly would risk introducing typo'd CRD names that fail on live
clusters — better to verify each chart's actual output first.

Components to enhance

(CRD lists above are best-effort guesses; the implementation PR
should re-verify against each pinned chart via helm template or by
inspecting the actual chart's crds/ directory.)

Approach

For each component:

1. Pull the chart at its pinned version (helm pull or helm template).
2. Enumerate every CRD the chart installs (typically under crds/,
   sometimes under templates/ for older charts).
3. Add (conditions[?type == 'Established']).status: True asserts
   for each, in a new validate-<comp>-crds-established step at the
   top of the component's recipes/checks/<comp>/health-check.yaml.
4. Live-cluster validation per component (the load-bearing step —
   typo'd CRD names fail at runtime).

Can land as one PR per component (granular, easier review) or one
PR per logical pair (e.g., slinky-slurm-operator together with its
slinky-slurm-operator-crds sibling). User preference.

Acceptance Criteria

• Every component listed above has at least one CRD asserted
  Established=True (where the chart actually installs CRDs — if
  any of these turn out not to ship CRDs in their pinned version,
  document the negative finding in the PR body).
• Allowlist sweep (TestValidateTestReadOnly_RegistryContent) +
  registry lint guard (TestComponentRegistry_RequiresHealthCheck)
  remain green.
• Live-cluster validation per touched component documented in the
  PR description.

Related

• PR feat(recipes): deepen 21 chainsaw health checks; close epic #660 #1245 (closed Enhance existing Chainsaw health checks (#660 PR 4) #1222, closed epic [EPIC] Reuse Chainsaw health checks in aicr validate --phase deployment #660) — the source of this deferral
• Epic [EPIC] Reuse Chainsaw health checks in aicr validate --phase deployment #660 — the broader chainsaw-deployment work