test(e2e): guard clickhouse-backup TIA mapping + tighten suite

- Add a select-e2e_test.bats case asserting a packages/apps/clickhouse diff
  selects BOTH the clickhouse and clickhouse-backup suites (mirrors the
  kubernetes-application multi-suite test). Fails without the src_to_suites
  override that makes the backup contracts suite run on ClickHouse chart PRs.
- Correct the backup-api-auth Secret assertion's prose to match what it proves
  (present with both keys, not "populated").
- Capture the to-copy restore target's Pod logs in the round-trip catch so a
  failure isolated to step 07 keeps its diagnostics.

Assisted-By: Claude <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Signed-off-by: Andrey Kolkov <androndo@gmail.com>

hack/e2e-chainsaw/clickhouse-backup/chainsaw-test.yaml

@@ -101,8 +101,9 @@ spec:
 
   # The strategy Pod authenticates to the sidecar with the credentials in the
   # chart-emitted <release>-backup-api-auth Secret (env API_USERNAME /
-  # API_PASSWORD on both sides). Assert it exists and is populated — a rename
-  # or an empty password surfaces only as 401s at BackupJob time otherwise.
+  # API_PASSWORD on both sides). Assert it exists and carries both keys — a
+  # rename of the Secret or a dropped key surfaces only as 401s (or a Pod that
+  # never starts) at BackupJob time otherwise.
   - name: verify-backup-api-auth-secret
     try:
     - assert:
@@ -152,6 +153,11 @@ spec:
   - podLogs:
       selector: app.kubernetes.io/instance=clickhouse-clickhouse-test
       tail: 100
+  # The to-copy leg (step 07) restores into a second release; capture its Pod
+  # logs too so a failure isolated to that leg keeps its diagnostics.
+  - podLogs:
+      selector: app.kubernetes.io/instance=clickhouse-clickhouse-restore
+      tail: 100
   steps:
   - name: run
     try:

hack/select-e2e_test.bats

@@ -99,6 +99,20 @@
     echo "$output" | grep -q "kubernetes-oidc-customconfig"
 }
 
+@test "clickhouse-application maps to both clickhouse suites" {
+    tmp=$(mktemp -d)
+    trap 'rm -rf "$tmp"' EXIT
+    cp -r packages/core/platform/sources "$tmp/sources"
+    echo "packages/apps/clickhouse/values.yaml" > "$tmp/diff"
+    output=$(hack/select-e2e.sh "$tmp/diff" "$tmp/sources")
+    # A ClickHouse chart-only change must select the plain clickhouse suite AND
+    # the backup contracts suite (which stands up the same chart with backup
+    # enabled) — that is the whole reason clickhouse-backup runs in CI. Match
+    # exact list tokens so "clickhouse" is not satisfied by "clickhouse-backup".
+    echo "$output" | tr ' ' '\n' | grep -xq clickhouse
+    echo "$output" | tr ' ' '\n' | grep -xq clickhouse-backup
+}
+
 @test "dashboards-only diff selects nothing (path is plural)" {
     tmp=$(mktemp -d)
     trap 'rm -rf "$tmp"' EXIT