fix(k8s): repair failing unit tests and guard assume_role_lib jq exit

[fedemaleh]

Summary

The BATS suite on beta had 6 failing tests out of 973 (all in k8s). This restores the suite to 973 tests, 0 failures.

Each failure was investigated individually rather than mechanically forcing tests green — important because one of them caught a real production bug.

Root causes & fixes

File	Type	Root cause
scope/tests/build_context.bats (2 tests)	stale test	scope/build_context now emits base_domain (commit f5026d2); expected JSON was never updated. Added the field to both public/private expectations.
deployment/tests/build_deployment.bats (2 tests)	stale test	deployment.yaml.tpl now requires cpu_millicores_limit/ram_memory_limit (CPU/mem limits feature). deployment/build_context normalizes these in production, but the test fed build_deployment a context skipping that step. Added the two _limit fields to _render_context.
scope/tests/wait_on_balancer.bats (1 test)	test bug	The retry mock's in-memory call_count never persisted because the script reads kubectl via command substitution $(...), which runs the mock in a subshell. Switched to a file-based counter.
utils/assume_role_lib (1 test)	production bug	arn_for_selector documents "never crashes, returns empty on malformed input" but propagated jq's exit code 5 on malformed JSON. The test was correct and caught it. Added `

Test plan

• ./testing/run_bats_tests.sh → 973 tests, 0 failures (was 6 failures)
• Re-ran each of the 4 affected files in isolation — all green.

Notes

No CHANGELOG entry: 3 are test-only fixes and 1 is a defensive hardening with no real-world behavior change (only affects malformed input that shouldn't occur), per the repo's "skip changelog for internal test / no user-visible change" convention.