[FEA]: gate operator-agent chainsaw script blocks by lint, or one check per script op

[rice-riley]

Summary

Chainsaw runs script.content as sh -c, so a block with several check_node.sh calls and no set -e gates only on its last command and every check above it is decorative. This has now been found and fixed three times in k8s-tests/operator-agent/ (#605, #673, #683), and nothing stops the next block from shipping the same way. Separately, with set -e a block stops at its first failing check, so when two checks would both fail only the first is reported, which hides the diagnostic that tells the two apart (raised on #683: a reaper that keeps the wrong count and trims from the wrong end reports only the count).

Proposal

Either or both of:

1. A CI lint over k8s-tests/ that fails any chainsaw script: block containing more than one command when it does not start with set -e (cleanup blocks that are deliberately non-gating would opt out with a marker comment). chainsaw does not appear to offer a per-test shell-options setting, so the lint is the practical route. lint-ci.yaml is the natural home.
2. One check per script: op in the assertion-heavy scenarios (simple/, reap_old_logs/, check_results/, service_restart/), so every failing check is reported independently and set -e per block becomes moot for those.

Option 2 makes option 1 unnecessary for the scenarios it touches, so they can land together or 1 can land first as the guard while 2 is done gradually.

Context

• test(agent): gate the simple and reap_old_logs operator-agent assertions #683 (comments from @lockwobr on simple/chainsaw-test.yaml:47 and reap_old_logs/chainsaw-test.yaml:59).
• ci(agent): run the operator-agent suite against the Go agent too #605 and fix(agent): let the running step finish on SIGTERM so gracefulShutdown holds #673 for the earlier rounds of the same defect.

Acceptance criteria

• A new multi-command script: block without set -e fails CI, or the affected scenarios no longer have multi-check blocks.
• Existing deliberately non-gating cleanup blocks (rm -rf ... || true) still pass.
• docs/contributing/ci-test-pools.md says which rule applies and how to opt a block out.

[mohityadav8]

/assign