BDD DSL: Validate second-wave changes on live EKS

Why

Second-wave DSL migrations affect live single- and multi-cluster EKS feature files. Local k3d validation cannot exercise AWS Gateway provisioning, ELB DNS propagation, EKS context handling, or the complete managed networking path.

Scope

Run the affected live EKS BDD scenarios after the second-wave migrations are available together. Validate the migrated operations against fresh, explicitly targeted single- and multi-cluster EKS environments and record actionable failures separately from DSL defects.

Acceptance criteria

• Identify every second-wave Pull Request that migrates an EKS feature and test the combined result at explicit commit SHAs.
• Run the affected single-cluster EKS Helmfile scenarios with an explicit Kubernetes context.
• Run the affected multi-cluster EKS Helmfile scenarios with explicit control-plane and compute-plane contexts.
• Exercise migrated Gateway route, DNS resolution, deployment rollout, NVCFBackend status, registry authentication, secrets preparation, and Helmfile environment operations where present.
• Start from fresh or explicitly approved reusable EKS environments and document cleanup authorization before destructive actions.
• Keep credentials and secret-bearing command output out of the test report.
• Attach a concise run record with commit SHAs, environment identifiers, scenarios, results, and retained artifacts.
• File separate public issues for product or test defects found during validation and link them here.

Parent: #858

Start by identifying every second-wave Pull Request that migrates an EKS feature, then run the affected single-cluster and multi-cluster EKS Helmfile BDD scenarios against explicitly targeted environments and contexts. Exercise the listed Gateway, DNS, rollout, NVCFBackend, registry, secrets, and environment operations. Done means a sanitized run record includes commit SHAs, environments, scenarios, results, retained artifacts, cleanup authorization, and separate issues for defects.