feat(T06): hostPath working-memory sync and repo-relative sink paths

Mount the-custodian memory/working from the railiance01 clone (hostPath)
so sweep writeback commits daily-triage notes; worker runs as uid 1000;
progress events store repo-relative working_memory_path; ops inventory
defaults use custodian:// URIs.

k8s/railiance/20-runtime.yaml

@@ -338,7 +338,7 @@ data:
     last_reviewed: "2026-06-05"
     policy:
       non_secret_inventory: true
-      source_of_truth: "/home/worsch/the-custodian/ops/service-inventory.yml"
+      source_of_truth: "custodian://ops/service-inventory.yml"
       projection: "Railiance activity-core ConfigMap snapshot for disabled probes"
     environments:
       - id: local
@@ -1012,6 +1012,10 @@ spec:
         app.kubernetes.io/name: actcore-worker
         app.kubernetes.io/part-of: activity-core
     spec:
+      securityContext:
+        runAsUser: 1000
+        runAsGroup: 1000
+        fsGroup: 1000
       containers:
         - name: worker
           image: activity-core:railiance01-prod
@@ -1051,8 +1055,9 @@ spec:
           configMap:
             name: actcore-ops-service-inventory
         - name: working-memory
-          persistentVolumeClaim:
-            claimName: actcore-working-memory
+          hostPath:
+            path: /home/tegwick/the-custodian/memory/working
+            type: DirectoryOrCreate
         - name: custodian-runtime
           configMap:
             name: actcore-custodian-runtime

k8s/railiance/README.md

@@ -19,7 +19,7 @@ loaded into the railiance01 K3s containerd image store.
 `20-runtime.yaml` also projects the disabled Custodian-owned
 `ops-service-inventory-probes.md` ActivityDefinition and a non-secret
 `actcore-ops-service-inventory` ConfigMap snapshot. The source of truth for the
-inventory remains `/home/worsch/the-custodian/ops/service-inventory.yml`; update
+inventory source of truth remains `custodian://ops/service-inventory.yml`; update
 the ConfigMap projection from that file before enabling the probe schedule.
 `OPS_HUB_KEY` is created only as an empty Secret placeholder until the operator
 provisions the Inter-Hub ops-hub key.
@@ -27,7 +27,8 @@ provisions the Inter-Hub ops-hub key.
 The same runtime projection now includes the active
 `daily-statehub-wsjf-triage.md` ActivityDefinition plus its JSON output schema
 and a persistent working-memory volume mounted at
-`/home/worsch/the-custodian/memory/working`. Before trusting the daily 07:20
+`/var/custodian/memory/working` (hostPath → `/home/tegwick/the-custodian/memory/working`).
+Before trusting the daily 07:20
 Europe/Berlin schedule, verify both runtime dependencies:
 
 - `actcore-state-hub-bridge` can reach the State Hub API through the node-local