test(e2e): snapshotted workspace volume and grant signer fixtures #293

Problem

A Session that starts in a clone of a snapshotted volume needs a proof in the fork's e2e lane (kind with the Substrate line), and the lane has none of its parts: no CSI driver with snapshot support, no volume holding git repositories, no snapshot handle to seed a clone from, and no issuer of the signed grant a Session volume is admitted with. The later pieces (admission, clone mount, per-Session credentials, the first-turn fetch) each need the same fixture.

Proposed solution

One PR, test code and lane setup only:

• The e2e kind lane installs the CSI hostpath driver with the external snapshotter (its CRDs, the snapshot controller, a VolumeSnapshotClass), beside what the lane already runs.
• A workspace fixture: a PVC that a Job fills with two repositories cloned in full from the lane's git fixture (the mock origin TestGitArtifactCredentialDelivery uses), checked out on their default branches under <owner>/<repository>, then a VolumeSnapshot of it; a helper waits for readyToUse and reads the CSI driver and the snapshot handle from the bound VolumeSnapshotContent. One of the repositories gets a commit pushed to the origin after the snapshot, so a later test can tell "changed since the snapshot" from "unchanged".
• A grant signer package for tests (go/core/test/...): a generated signing key, its JWKS served by an httptest server, and SignGrant(subject, snapshot{driver, handle}, changed []string, providers []Provider, ttl) producing the JWT the Session admission verifies. The controller in the lane is configured against that JWKS.
• Assertion helpers reused by the later tests: "no token in the sandbox" (environment, /data, the clone) and "the origin logged no request for repository X".

Acceptance criteria

• The lane brings up the snapshotter and a ready VolumeSnapshot of the fixture PVC; a test reads its driver and handle and the two repositories' head commits
• The signer's grant verifies against its JWKS in a unit test; an expired one and one for another subject are rejected by the same verifier
• The fixture is documented in the e2e README (what it holds, how a test uses it)