feat: webhook HA, security hardening, and RBAC naming cleanup

[scotwells]

Summary

• Renames the manager Deployment from compute to compute-manager to avoid ambiguity with the broader system name
• Adds a new config/components/high-availability kustomize component with:
  • replicas: 2 — eliminates the single-replica webhook availability gap on pod restart
  • PodDisruptionBudget (minAvailable: 1) — prevents simultaneous eviction of both pods during node maintenance
  • topologySpreadConstraints (kubernetes.io/hostname, DoNotSchedule) — ensures the two replicas land on different nodes so a node failure or drain cannot take down both pods at once
• Wires the high-availability component into config/overlays/single-cluster
• Hardens the manager security context to the Kubernetes restricted pod security standard:
  • seccompProfile: RuntimeDefault at the pod level
  • runAsUser/runAsGroup: 65532 pinned to match the distroless nonroot image USER
  • readOnlyRootFilesystem: true at the container level
• Prefixes all RBAC ClusterRole and ClusterRoleBinding names with compute- to prevent collisions with other controllers in the same cluster

Consumers that want a single replica (e.g. staging) simply omit the high-availability component from their overlay.

Closes #91

Test plan

• kustomize build config/overlays/single-cluster/ produces a Deployment named compute-manager with replicas: 2, a PodDisruptionBudget with minAvailable: 1, and topologySpreadConstraints on kubernetes.io/hostname
• kustomize build config/base/manager/ still builds cleanly with replicas: 1 and no PDB
• All ClusterRole and ClusterRoleBinding names in the build output are prefixed with compute-
• Deploy to a test cluster and verify both pods become Ready and the webhook remains available during a kubectl rollout restart
• Verify pods are scheduled on separate nodes

🤖 Generated with Claude Code