fix: add PodSecurity contexts to all poimen deployments

- runAsNonRoot, runAsUser 1000, seccompProfile RuntimeDefault
- Drop ALL capabilities, no privilege escalation
- readOnlyRootFilesystem on memory (with /tmp emptyDir)
- git-sync init runs as root with only CHOWN+DAC_OVERRIDE caps
- All pods use their service accounts

k8s/app/deployment.yaml

@@ -19,9 +19,23 @@ spec:
       labels:
         app.kubernetes.io/name: poimen-memory
     spec:
+      serviceAccountName: poimen-memory
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 1000
+        runAsGroup: 999
+        fsGroup: 999
+        seccompProfile:
+          type: RuntimeDefault
       containers:
         - name: memory
           image: forgejo.riotpiao.com/rock/poimen-memory:latest
+          securityContext:
+            allowPrivilegeEscalation: false
+            readOnlyRootFilesystem: true
+            capabilities:
+              drop:
+                - ALL
           imagePullPolicy: Always
           ports:
             - containerPort: 8080
@@ -85,10 +99,15 @@ spec:
           volumeMounts:
             - name: data
               mountPath: /data
+            - name: tmp
+              mountPath: /tmp
       volumes:
         - name: data
           persistentVolumeClaim:
             claimName: poimen-memory-vault
+        - name: tmp
+          emptyDir:
+            sizeLimit: 64Mi
       # Tolerate control-plane nodes
       tolerations:
         - key: node-role.kubernetes.io/control-plane