Harden the Kubernetes runtime

[ty-everett]

PaperTrade's namespace warns on Pods that rely on default root privileges and an automatically mounted service-account token. This change runs the application as the image's existing node user, applies RuntimeDefault seccomp, drops all capabilities, disables privilege escalation and token mounting, and gives the emptyDir scratch volume a matching fsGroup.

Validation:

• production Kustomize render and server-side dry-run passed
• isolated live canary ran as UID/GID 1000, Ready with zero restarts and no PVC
• canary health, normalized 11-publication catalog, and known page hash matched production
• all ten starter timestamps remained unchanged