e2e: the opensearch suite reads HelmRelease history with a literal jsonpath the upstream pin does not cover #4550

The opensearch e2e suite reads HelmRelease history with its own copy of the jsonpath, so the upstream pin on that read does not cover it. In hack/e2e-chainsaw/opensearch/chainsaw-test.yaml:524-525 on main the step sources hack/e2e-chainsaw/_lib/remediation-guard.sh and then runs:

statuses=$(kubectl -n "$NAMESPACE" get helmrelease opensearch-test \
  -o jsonpath='{range .status.history[*]}{.status}{"\n"}{end}')

The library exports HELMRELEASE_HISTORY_JSONPATH for exactly this read, and internal/fluxcontract pins that variable against the upstream Flux type. docs/agents/e2e-testing.md section 6 says a copied literal is not covered by that pin. If Flux renames the field, this read goes empty without the Go test noticing. The suite's own "empty history on a Ready HR" check would still fail the run, so the impact is low.

Fix: use -o "jsonpath=${HELMRELEASE_HISTORY_JSONPATH}" here. It may also be worth letting the fluxcontract caller check see chainsaw suites, so the next copy is caught.