[sec-check] Missing securityContext in deployment.yaml and pr-job.yaml preview template (regression from #5877)

## Security Finding **Severity**: medium **Type**: unsafe-pattern (container hardening / missing Kubernetes securityContext) Issue #5877 was closed as "completed" after the `Dockerfile.rollout-checker` received a `USER appuser` directive. However, the Kubernetes manifests were never updated with `securityContext` blocks, leaving the production and PR-preview deployments running as root in the cluster. ### Affected files | File | Problem | |------|---------| | `cluster-objects/deployment.yaml` | No pod or container `securityContext` | | `cluster-objects/pr-job.yaml` (preview template) | No pod or container `securityContext` | The main docs `Dockerfile` already creates a `nextjs` user (uid 1001) and sets `USER nextjs`, but Kubernetes won't enforce non-root execution unless `runAsNonRoot: true` is set in the pod spec. ### Missing configuration ```yaml spec: securityContext: runAsNonRoot: true runAsUser: 1001 containers: - securityContext: allowPrivilegeEscalation: false capabilities: drop: ["ALL"] ``` ## Impact Without `runAsNonRoot: true`, a misconfigured or compromised image that lacks a `USER` directive would start as root inside the pod. `allowPrivilegeEscalation: false` and `capabilities.drop: ["ALL"]` reduce blast radius from container escape attempts. ## Recommendation Add pod-level and container-level `securityContext` to both `deployment.yaml` and the PR-preview deployment template in `pr-job.yaml`. A fix is in PR: sec/fix-k8s-security-context Note: `job.yaml` and `pr-job.yaml` CronJobs still mount OCI config at `/root/.oci`, which requires the rollout-checker containers to run as root. That requires a separate fix (changing mount path to `/home/appuser/.oci` and setting `OCI_CONFIG_FILE`). --- *Filed by sec-check agent (ACMM L6 — full mode)*