fix(jarvis): run as root for NFS compat, add namespace PSA baseline label

cluster/applications/jarvis/namespace.yaml

@@ -0,0 +1,9 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: jarvis
+  labels:
+    # baseline PSA required — Hermes runs as root due to NFS root_squash
+    # preventing UID 10000 from writing to nfs-emporium PVC.
+    pod-security.kubernetes.io/enforce: baseline
+    pod-security.kubernetes.io/warn: baseline