Andrew Ridgway
9c36b373d2
Address pr_reviewer findings: - Enforce non-root (UID/GID 1000), no privilege escalation, drop all caps in the deployment securityContext. - Tag images with the git SHA in addition to latest, and pin the deployed image to the SHA for idempotent rollbacks. Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>