fix(k3s): enable nonroot-devices so CDI can import to Block-mode PVCs

The UniFi VM boot-disk DataVolume (RWX + Block on longhorn-vm) failed to import:
CDI's non-root importer (UID 107, cap-drop ALL) hit
`blockdev: cannot open /dev/cdi-block-volume: Permission denied`.

Kubernetes only applies fsGroup ownership to *filesystem* volumes — it never
chowns a raw block device — and Longhorn's CSIDriver (fsGroupPolicy:
ReadWriteOnceWithFSType) skips fsGroup on RWX/Block volumes regardless, so the
device stays root:root. The CDI-documented fix is the container-runtime setting
`device_ownership_from_security_context`, exposed on k3s (>= v1.31.3+k3s1, this
cluster is v1.31.5) as `nonroot-devices: true`. It makes containerd set the
in-container device node's owner from the pod's securityContext.

Added to the Ansible-managed /etc/rancher/k3s/config.yaml alongside tls-san;
applied via the existing rolling `Restart k3s` handler (serial:1, kube-vip keeps
the API up, etcd holds 2/3). Node-scoped, security-neutral (pods stay non-root),
and preserves the longhorn-vm RWX/Block/migratable contract unchanged.

Co-Authored-By: Claude Opus 4.8 <[email protected]>

apps/vms/unifi/20-datavolume.yaml

@@ -21,6 +21,11 @@
 # the importer runs in THIS default-deny namespace, unlike the conformance test whose ephemeral
 # ns has no baseline). No checksum is verified on an http source; pin a dated build for full
 # reproducibility if drift matters (see README "Open questions").
+#
+# NODE PREREQ (Block-mode CDI): the non-root importer opens the raw block device, which k8s
+# never chowns for it. The k3s nodes set `nonroot-devices: true`
+# (infra/ansible/roles/k3s_server) so containerd hands the device to the pod's UID/GID —
+# without it the import dies with `blockdev: cannot open /dev/cdi-block-volume: Permission denied`.
 apiVersion: cdi.kubevirt.io/v1beta1
 kind: DataVolume
 metadata: