[test] Check subnet isolation through interface routes

[komer3]

Summary

The subnet test now checks VPC interface routes instead of searching CCM logs. It requires each node's Pod CIDR route and rejects routes from the other cluster.

Missing routes are polled every five seconds, with a shared three-minute deadline. Foreign routes and API errors fail immediately. The testing docs describe this behavior.

Validation

• All CI workflows passed, including the live E2E suite and subnet test.
• Local Chainsaw lint and 11 synthetic runtime scenarios passed.

General:

• No sensitive information.
• Checked for duplicate PRs.

Pull Request Guidelines:

• Tests pass.
• New tests added (updated the existing subnet scenario).
• Single focused change.
• Atomic implementation commit.
• Follows language conventions.
• No unrelated formatting changes.
• Rationale explained above.
• Public issue linked.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 75.40%. Comparing base (2fa074b) to head (03e9437).

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #637   +/-   ##
=======================================
  Coverage   75.40%   75.40%           
=======================================
  Files          19       19           
  Lines        2887     2887           
=======================================
  Hits         2177     2177           
  Misses        481      481           
  Partials      229      229           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.