fix(apps): semaphore fsGroup — schema 1.3.0 podSecurityContext for non-root PVC write

The semaphoreui/semaphore image runs as non-root UID 1001 / GID 0 and writes its
generated config.json into the config dir on boot. A mounted Longhorn PVC is
root:root, so UID 1001 got "permission denied" and the pod crash-looped.

First-class the fix into the render contract (same mechanism the retired
gitea-bootstrap-patch was replaced by): schema 1.3.0 adds an optional pod-level
`podSecurityContext`, emitted verbatim onto spec.template.spec.securityContext by
render.py. Absent => every other app renders byte-identical (verified). semaphore
declares fsGroup=1001 (kubelet group-owns the PVC + adds the supplemental group so
UID 1001 can write) plus runAsUser/runAsGroup/runAsNonRoot pinning the image identity.

render.py selftest extended (verbatim render + absence). L0 (schema+kyverno 17/17),
L1 3/3, lint all green.

Co-Authored-By: Claude Opus 4.8 <[email protected]>

catalog/render.py

@@ -251,6 +251,14 @@ def r_deployment(s: dict) -> dict:
         container["lifecycle"] = s["lifecycle"]
 
     pod_spec = {"containers": [container]}
+
+    # podSecurityContext (schema-optional): the k8s PodSecurityContext is emitted VERBATIM onto the
+    # pod spec. Its primary use is `fsGroup`, which makes a mounted Longhorn PVC group-writable by a
+    # non-root image (e.g. semaphore runs as UID 1001 and cannot otherwise write its config PVC).
+    # Absent => the key is never set, so apps that declare none render byte-identical.
+    if s.get("podSecurityContext"):
+        pod_spec["securityContext"] = s["podSecurityContext"]
+
     if volumes:
         pod_spec["volumes"] = volumes
 
@@ -1132,11 +1140,17 @@ def _selftest() -> int:
             "lifecycle": {
                 "postStart": {"exec": {"command": ["/bin/sh", "-c", "echo hi"]}}
             },
+            "podSecurityContext": {"fsGroup": 1001, "runAsUser": 1001},
         }
     )
-    ec = next(
+    envd_pod = next(
         d[1] for d in envd_docs if d[1]["kind"] == "Deployment"
-    )["spec"]["template"]["spec"]["containers"][0]
+    )["spec"]["template"]["spec"]
+    check(
+        envd_pod.get("securityContext") == {"fsGroup": 1001, "runAsUser": 1001},
+        "podSecurityContext must render verbatim onto the pod spec",
+    )
+    ec = envd_pod["containers"][0]
     check(
         ec.get("env") == [
             {"name": "PLAIN", "value": "literal"},
@@ -1164,6 +1178,14 @@ def _selftest() -> int:
         and "lifecycle" not in plain_c,
         "an SD without env/envFrom/lifecycle must not gain those container keys",
     )
+    plain_pod = next(
+        d[1] for d in render({"name": "plain2", "source": {"image": "a:1"}})
+        if d[1]["kind"] == "Deployment"
+    )["spec"]["template"]["spec"]
+    check(
+        "securityContext" not in plain_pod,
+        "an SD without podSecurityContext must not gain a pod securityContext",
+    )
 
     if failures:
         for f in failures: