fix(jarvis): move runAsNonRoot to container level, allow init container to run as root for chown

cluster/applications/jarvis/deployment.yaml

@@ -1,21 +1,10 @@
 # ------------------------------------------------------------------------------
 # Hermes Agent (jarvis) — Deployment + Service + PVC
 #
-# Hermes requires a one-time interactive setup before first gateway run.
-# See bootstrap procedure below before applying for the first time.
-#
-# Bootstrap procedure (run once):
-#   1. kubectl run hermes-setup -it --rm --image=nousresearch/hermes-agent \
-#        --overrides='{"spec":{"volumes":[{"name":"data","persistentVolumeClaim":{"claimName":"jarvis-data"}}],"containers":[{"name":"hermes-setup","image":"nousresearch/hermes-agent","command":["setup"],"stdin":true,"tty":true,"volumeMounts":[{"name":"data","mountPath":"/opt/data"}]}]}}' \
-#        -n jarvis
-#   2. Complete the setup wizard:
-#      - Provider: Ollama (custom endpoint)
-#      - Base URL: http://astro-orbiter.local.mk-labs.cloud:11434/v1
-#      - API Key: none (leave blank)
-#      - Model: qwen3:8b
-#      - Messaging: skip for now
-#   3. Verify config was written: kubectl exec -n jarvis <pod> -- ls /opt/data
-#   4. Apply the rest of the manifests (ArgoCD will handle from here)
+# Bootstrap procedure (run once before first deploy):
+#   1. Create namespace and PVC, run hermes setup wizard on scrim
+#   2. kubectl cp config.yaml into jarvis-data PVC via busybox init pod
+#   3. Push manifests — ArgoCD deploys against pre-populated PVC
 # ------------------------------------------------------------------------------
 apiVersion: v1
 kind: PersistentVolumeClaim
@@ -28,7 +17,6 @@ spec:
   resources:
     requests:
       storage: 5Gi
-  # Uses cluster default StorageClass (Ceph/Longhorn — whatever fastpass has)
 ---
 apiVersion: apps/v1
 kind: Deployment
@@ -48,8 +36,6 @@ spec:
         app: jarvis
     spec:
       securityContext:
-        runAsNonRoot: true
-        runAsUser: 10000
         seccompProfile:
           type: RuntimeDefault
       initContainers:
@@ -74,6 +60,8 @@ spec:
             - containerPort: 8642
               name: gateway
           securityContext:
+            runAsNonRoot: true
+            runAsUser: 10000
             allowPrivilegeEscalation: false
             capabilities:
               drop: ["ALL"]