fix(jarvis): run as root for NFS compat, add namespace PSA baseline label

cluster/applications/jarvis/deployment.yaml

@@ -35,23 +35,13 @@ spec:
       labels:
         app: jarvis
     spec:
+      # Running as root to work around NFS root_squash preventing UID 10000
+      # from writing to the PVC. Hermes supports root execution.
+      # PSA namespace must be set to baseline or privileged for this to work.
       securityContext:
+        runAsUser: 0
         seccompProfile:
           type: RuntimeDefault
-      initContainers:
-        - name: fix-ownership
-          image: busybox
-          command: ["sh", "-c", "chown -R 10000:10000 /opt/data"]
-          securityContext:
-            runAsNonRoot: false
-            runAsUser: 0
-            allowPrivilegeEscalation: false
-            capabilities:
-              drop: ["ALL"]
-              add: ["CHOWN"]
-          volumeMounts:
-            - name: data
-              mountPath: /opt/data
       containers:
         - name: hermes
           image: nousresearch/hermes-agent:latest
@@ -60,8 +50,7 @@ spec:
             - containerPort: 8642
               name: gateway
           securityContext:
-            runAsNonRoot: true
-            runAsUser: 10000
+            runAsUser: 0
             allowPrivilegeEscalation: false
             capabilities:
               drop: ["ALL"]
@@ -74,6 +63,10 @@ spec:
               value: "0.0.0.0"
             - name: API_SERVER_CORS_ORIGINS
               value: "*"
+            - name: HERMES_UID
+              value: "0"
+            - name: HERMES_GID
+              value: "0"
           volumeMounts:
             - name: data
               mountPath: /opt/data

cluster/applications/jarvis/namespace.yaml

@@ -0,0 +1,9 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: jarvis
+  labels:
+    # baseline PSA required — Hermes runs as root due to NFS root_squash
+    # preventing UID 10000 from writing to nfs-emporium PVC.
+    pod-security.kubernetes.io/enforce: baseline
+    pod-security.kubernetes.io/warn: baseline