e2e: monitoring OIDC has no Chainsaw coverage (port the removed BATS pair) #4051

hack/e2e-chainsaw/ has no monitoring OIDC coverage, in either shape.

The two BATS suites that carried it, hack/e2e-apps/monitoring-oidc-system.bats and
hack/e2e-apps/monitoring-oidc-customconfig.bats, were executed by nothing and are removed in
#3520, which takes the decision #3638 and #3786 asked for. This issue keeps the other half of that
decision on the board: the port is still wanted, as an ordinary feature request rather than as an
executable file nothing runs.

What the removed pair asserted on a live cluster, and what a port would need to reproduce:

• System mode (monitoring-oidc-system.bats): that spec.oidc.* is admitted on the Monitoring
  CR and accepted by cozystack-api; that the HelmRelease renders the OIDC templates; and that the
  resulting KeycloakClient, audience KeycloakClientScope, persistent client-secret Secret,
  Grafana CR and users-reconcile Job carry the expected shape. Authorization is asserted through the
  users-Job reconciling spec.oidc.users into Grafana orgs, not through chart-owned
  KeycloakRealmGroups or role_attribute_path (see the design note in docs/oidc-grafana.md).
• Custom config mode (monitoring-oidc-customconfig.bats): the BYO issuer path, including the
  negative assertions that no chart-owned Keycloak object is created.

Neither drove a browser login through Keycloak; that was deferred, same posture as the tenant
kube-apiserver suites, and a port need not take it on.

Two things to know before writing it:

• The removed suites skipped when the EDP Keycloak CRDs were absent, and the probe they used tested
  the exit code of kubectl api-resources, which is 0 for an absent API group. Probe the output
  (--output=name piped to an anchored grep), and keep a failed discovery call distinct from an
  empty list: a test has no reason to conflate them.
• The skip those suites called does not exist in hack/cozytest.sh (cozytest.sh implements no skip: a skipping test hard-fails at exit 127 #3827). Chainsaw has its own
  skip semantics, so this only matters if the port lands in BATS after all.

Existing coverage nearby: packages/system/monitoring/tests/oidc_test.yaml covers the render side as
Helm unit tests, so a Chainsaw port is about admission and reconciliation on a real cluster, not
about template output. #3785 tracks a separate gap in the same area (mode swap from inline to
secretRef).