add CEL assertions for test checks

[atkrad]

Summary

• Add a test helper that compiles a boolean CEL expression once and checks it against JSON and Kubernetes objects.
• A canceled context, a non-boolean result, or an integer outside int64 fails the check.
• cel-go stays in the test module. The deployah binary does not import it.

Test plan

• Unit tests added/updated
• Scenario under scenarios/ (if behavior changes)
• nix run .#lint / pre-commit clean
• Manual smoke (command + expected result), if user-facing

Labels

• One of: kind/feature, kind/bug, kind/docs, kind/chore
• Add breaking-change if this breaks existing CLI or config behavior
• Add skip-changelog for internal-only PRs that should not appear in notes

Checklist

• Title is short and imperative (matches commit style)
• Docs / CLI help updated when user-facing (README.md, docs/cli/)
• No secrets or local-only paths in the diff

[codecov]

Codecov Report

❌ Patch coverage is 97.98658% with 3 lines in your changes missing coverage. Please review.
✅ All tests successful. No failed tests found.

Files with missing lines	Patch %	Lines
internal/testing/celassert/program.go	97.98%	3 Missing ⚠️

📢 Thoughts on this report? Let us know!