…lane (closes projectbluefin#67)

Defines the printer-device access and LAN mDNS discovery validation lane as
a standalone split from the base print-service lane (projectbluefin#64).  Makes the
substrate dependencies (projectbluefin#54) explicit and keeps them out of the base lane.

## Dependency chain

  projectbluefin#54 substrate (USB device passthrough + LAN network policy on ghost)
      → projectbluefin#67 this lane (USB access + mDNS discovery contract proven)
      → projectbluefin#64 base print lane (already unblocked; this lane extends it)

## New files

### tests/service_catalog/print_device/test_print_device_discovery.py
Two test classes with independent skip gates:

TestPrinterDeviceAccessLane (gate: TEST_USB_PRINTER_DEVICE env var)
- test_usb_device_node_exists_in_container
- test_usb_device_node_is_character_device
- test_cups_can_detect_local_usb_printer (lpinfo -v)
- test_cups_accepts_test_print_job (lp + cancel)
- test_usb_device_permissions_allow_cups_user
- test_kubevirt_usb_passthrough_is_out_of_scope → pytest.skip → projectbluefin#54

TestLanDiscoveryLane (gate: TEST_AVAHI_ENABLED=true)
- test_ipp_service_exposed_outside_cluster (NodePort/LB)
- test_nodeport_is_reachable_on_node_ip
- test_avahi_sidecar_container_is_running
- test_avahi_daemon_process_is_active
- test_avahi_daemon_advertises_ipp_service (avahi-browse _ipp._tcp)
- test_avahi_service_file_is_present_in_config
- test_auth_gated_cups_ui_is_out_of_scope → pytest.skip → deferred
- test_split_horizon_dns_for_cups_is_out_of_scope → pytest.skip → bluespeed

Both classes skip cleanly when their gate condition is not met so non-hardware
CI is not broken.

### argo/workflow-templates/homelab-print-device.yaml
WorkflowTemplate with three parameters controlling hardware paths:
- usb-device-path: set to /dev/usb/lp0 to enable USB tests (hostPath volume)
- avahi-enabled: set to 'true' to enable mDNS tests (NodePort svc + avahi sidecar)
- ipp-nodeport: default 30631

check-prerequisites guard step emits informative messages about projectbluefin#54 requirements
but does not fail — tests self-skip when conditions are absent.

Fixture uses lscr.io/linuxserver/cups:latest (real CUPS image, not nginx stub)
because USB tests require actual CUPS commands (lpinfo, lp, lpstat).

Avahi sidecar uses ubuntu:22.04 + avahi-daemon + ConfigMap service definition
for the _ipp._tcp record.

### argo/homelab-print-device.yaml
Workflow submit trigger.

## Updated files

### docs/homelab-contracts.md
- §6 known-blockers: projectbluefin#67 → ✅ defined
- §7 Printer-Device Access and LAN Discovery Lane added:
  boundary table (base vs this lane), substrate assumptions tables,
  behavior tables for both test classes, WorkflowTemplate parameters table

Closes projectbluefin#67
Child of projectbluefin#51
Depends on projectbluefin#54 (substrate), projectbluefin#64 (base print lane)

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>