fix(cloudflared): fsGroup so uid 65532 can read the 0440 credentials Secret

The pod ran as 65532:65532 with no fsGroup, so the kubelet laid the Secret's
credentials.json down root:root 0440 — unreadable to the container. cloudflared
logged "permission denied" and then the red-herring "Error locating origin cert".

- deployment.yaml: securityContext.fsGroup 65532 (mode stays 0440)
- L0 cloudflared-ingress-rules (7): Secret volumes must be readable by the
  container's run-as uid/groups; mutation self-tested
- runbook: permission-denied troubleshooting entry, credential rotation section
- decisions/2026-11-08-cloudflared-creds-permission.md

Co-Authored-By: Claude Opus 5.5 <[email protected]>

platform/cloudflared/deployment.yaml

@@ -47,6 +47,14 @@ spec:
         # The image is distroless `nonroot` (65532).
         runAsUser: 65532
         runAsGroup: 65532
+        # fsGroup makes the kubelet GROUP-own the Secret volume's files to 65532. Without it they
+        # are root:root, and defaultMode 0440 (below) is unreadable to uid 65532 — every replica
+        # CrashLooped on "couldn't read tunnel credentials ... permission denied" (2026-11-08),
+        # which cloudflared then misreports as "Error locating origin cert". Same lesson as
+        # platform/keycloak/client-secret-reconciler.yaml. fsGroup + 0440 keeps the credential
+        # unreadable to any other uid rather than relaxing it to world-readable 0444.
+        # Pinned by the L0 check cloudflared-ingress-rules, assertion (7).
+        fsGroup: 65532
         seccompProfile:
           type: RuntimeDefault
       topologySpreadConstraints:
@@ -121,6 +129,8 @@ spec:
           secret:
             # cloudflared-credentials.sops.yaml — the tunnel credentials JSON, by name only.
             secretName: cloudflared-credentials
+            # 0440, owner root, group fsGroup 65532 (pod securityContext) — readable by the
+            # container user through its group, by nobody else.
             defaultMode: 0440
 ---
 # One replica may be disrupted at a time — enough for kured's one-node-at-a-time drain to