Layer 1: scenarios-as-modules (Cl2Benchmark archetype + Kata demo + cycle gate)

[Bickor]

Summary

Draft for review. Introduces Layer 1 of the modularization effort: authoring a whole Telescope test (a scenario) as a reusable KCL module, so scenario owners can stand up or tweak a benchmark with a couple of changes instead of hand-writing the full pipeline.

Three self-contained commits:

1. Cl2Benchmark scenario archetype (2100b44)

   • Adds kcl/lib/scenario/cl2_benchmark.k: a schema + builder that captures the shared CL2 pipeline spine (resource group → cluster → node pool → CreateKwokNodes → RunClusterLoader2 → collect/upload → cleanup).
   • Proven non-regressive: kcl/example_pipeline/pipeline.k rebuilt on the archetype regenerates byte-identical pipeline.yaml vs. the prior hand-written output.

2. Kata benchmark scenario (cc9b50a)

   • Demonstrates the archetype's reuse: a new scenario enabled via two touch-points only —
     • nodePool.runtime = "kata" → --workload-runtime KataMshvAccVmIsolation + nested-virt SKU, and
     • CL2_RUNTIME_CLASS_NAME in the cl2-override ConfigMap → measured pods get runtimeClassName.
   • Adds kcl/lib/scenario/cl2_manifest.k (typed Cl2Override/Cl2Manifest + buildCl2Manifest) so a scenario can generate its own cl2.yaml from KCL (kcl run -S manifests). RunClusterLoader2 is unchanged; cl2Manifest stays a path.

3. Cross-scenario reference cycle validation gate (0ab8c87)

   • scripts/validate_scenarios.py: a thin /generate_yaml gate catching path-string cross-scenario reference cycles (one scenario's cl2Manifest/kwokNodeManifest pointing into another scenario's directory) — the one blind spot KCL's compiler cannot see.
   • KCL already rejects circular imports (E1001 RecursiveLoad); this gate deliberately does not re-check those. format_kcl_cycle_error() just reframes that native diagnostic in scenario terms.
   • scripts/test_validate_scenarios.py: 21 unittest cases (GREEN); documented in the generate-yaml skill.

What to review

• Archetype boundary: is Cl2Benchmark's field set the right seam, and is the path-string cl2Manifest contract acceptable vs. inlining?
• Kata enablement ergonomics (the two touch-points).
• Scope of the validation gate (path-string cycles only; leaning on KCL for import cycles).

Not in this PR (deliberately deferred)

• Layer 2 (named, tool-agnostic metric catalog + the missing CollectClusterLoader2Result step).
• Open decisions: escape-hatch boundary for Karpenter/private/cilium, catalog mechanism, Kata SKU/runtime defaults, emit naming alignment.

Validation

$ python3 scripts/test_validate_scenarios.py   # 21 tests, OK
$ python3 scripts/validate_scenarios.py         # OK (no cross-scenario reference cycles)
$ kcl run kcl/example_pipeline/pipeline.k -S output -o /tmp/out.yaml  # byte-identical to committed golden