feat(chart): expose podSecurityContext and securityContext values

[vishwakt]

What

Closes #1253.

Adds podSecurityContext (pod-level) and securityContext (container-level) values to the Helm chart and wires them into both the Deployment and DaemonSet templates (chart/templates/deployment.yaml, chart/templates/daemonset.yaml).

Secure defaults are shipped, as proposed in the issue, so the controller no longer runs as root with a writable root filesystem out of the box:

podSecurityContext:
  runAsNonRoot: true
  runAsUser: 65532
  seccompProfile:
    type: RuntimeDefault
securityContext:            # container-level
  readOnlyRootFilesystem: true
  allowPrivilegeEscalation: false
  capabilities:
    drop: ["ALL"]

Why

This satisfies the Pod Security restricted profile and common lint gates (kube-linter run-as-non-root / no-read-only-root-fs), removing the need for repo-wide lint waivers or post-render kustomize patches on hardened clusters.

Notes

• readOnlyRootFilesystem: true is safe: the runtime controller does not write to its root filesystem (the only filesystem writes in the repo are in tools/ and internal/testsupport/, neither of which is in the runtime path). No writable emptyDir is needed.
• The image runs as root (no USER in the Dockerfile), so runAsNonRoot is correctly paired with an explicit runAsUser: 65532.
• Both blocks are {{- with }}-guarded, so operators can relax or disable them by overriding the values (e.g. set to {}).
• This changes behavior on upgrade for existing installs (they flip to non-root + read-only root fs). Flagging for release-note visibility.
• Regenerated chart snapshots (chart/.snapshots/*.yaml) and deploy manifests (deploy/ccm.yaml, deploy/ccm-networks.yaml); helm lint passes.

🤖 Generated with Claude Code