test(mariadb): bind the uninstall assertions to the delete verb

Both suites matched only the Secret name list in the hook's script, so
replacing kubectl delete with kubectl get left all 106 cases green while
the CA private key and the server private key survived the release. The
verb is the claim these tests exist to make; the names alone are just
text that happens to appear in a shell script.

Assisted-by: LLM
Signed-off-by: Aleksei Sviridkin <f@lex.la>

packages/apps/mariadb/tests/cleanup_hook_test.yaml

@@ -23,12 +23,15 @@ tests:
       path: kind
       value: Job
     asserts:
+      # The verb is part of the assertion. Matching the name list alone leaves
+      # the whole point of the hook — that these Secrets are REMOVED — pinned by
+      # nothing, so `kubectl get secret` in place of the delete stays green.
       - matchRegex:
           path: spec.template.spec.containers[0].command[2]
-          pattern: "mariadb-test-metrics-password mariadb-test-repl-password"
+          pattern: "(?s)kubectl delete secret -n \\S+.*mariadb-test-metrics-password mariadb-test-repl-password"
       - matchRegex:
           path: spec.template.spec.containers[0].command[2]
-          pattern: "mariadb-test-ca-tls mariadb-test-tls --ignore-not-found"
+          pattern: "(?s)kubectl delete secret -n \\S+.*mariadb-test-ca-tls mariadb-test-tls --ignore-not-found"
 
   - it: "cleanup Job fails (exits non-zero) when a real delete error occurs, so orphaned resources don't pass silently"
     documentSelector:

packages/apps/mariadb/tests/cleanup_pvc_hook_test.yaml

@@ -81,12 +81,14 @@ tests:
   - it: deletes the key-bearing cert-manager Secrets on uninstall
     documentIndex: 0
     asserts:
+      # Bound to the delete: a name reachable by any other verb says nothing
+      # about whether the key outlives the release.
       - matchRegex:
           path: spec.template.spec.containers[0].command[2]
-          pattern: "mariadb-test-ca-tls"
+          pattern: "(?s)kubectl delete secret -n \\S+.*mariadb-test-ca-tls"
       - matchRegex:
           path: spec.template.spec.containers[0].command[2]
-          pattern: "mariadb-test-tls"
+          pattern: "(?s)kubectl delete secret -n \\S+.*mariadb-test-tls"
       # -ca-bundle carries an ownerRef to the MariaDB resource, so Kubernetes
       # collects it; deleting it here would need a grant that is not warranted.
       - notMatchRegex: