fix: add PodSecurity contexts to all poimen deployments

- runAsNonRoot, runAsUser 1000, seccompProfile RuntimeDefault
- Drop ALL capabilities, no privilege escalation
- readOnlyRootFilesystem on memory (with /tmp emptyDir)
- git-sync init runs as root with only CHOWN+DAC_OVERRIDE caps
- All pods use their service accounts

k8s/app/obsidian.yaml

@@ -21,9 +21,26 @@ spec:
         app.kubernetes.io/part-of: poimen-memory
     spec:
       serviceAccountName: obsidian-server
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 1000
+        runAsGroup: 1000
+        fsGroup: 1000
+        seccompProfile:
+          type: RuntimeDefault
       initContainers:
       - name: git-sync-init
         image: alpine/git:latest
+        securityContext:
+          runAsNonRoot: false
+          runAsUser: 0
+          allowPrivilegeEscalation: false
+          capabilities:
+            drop:
+              - ALL
+            add:
+              - CHOWN
+              - DAC_OVERRIDE
         command:
         - sh
         - -c
@@ -50,6 +67,11 @@ spec:
       - name: obsidian-server
         image: ppatlabs/obsidian:latest
         imagePullPolicy: IfNotPresent
+        securityContext:
+          allowPrivilegeEscalation: false
+          capabilities:
+            drop:
+              - ALL
         ports:
         - name: http
           containerPort: 27124