feat(T06): hostPath working-memory sync and repo-relative sink paths

Mount the-custodian memory/working from the railiance01 clone (hostPath)
so sweep writeback commits daily-triage notes; worker runs as uid 1000;
progress events store repo-relative working_memory_path; ops inventory
defaults use custodian:// URIs.

k8s/railiance/20-runtime.yaml

@@ -338,7 +338,7 @@ data:
     last_reviewed: "2026-06-05"
     policy:
       non_secret_inventory: true
-      source_of_truth: "/home/worsch/the-custodian/ops/service-inventory.yml"
+      source_of_truth: "custodian://ops/service-inventory.yml"
       projection: "Railiance activity-core ConfigMap snapshot for disabled probes"
     environments:
       - id: local
@@ -1012,6 +1012,10 @@ spec:
         app.kubernetes.io/name: actcore-worker
         app.kubernetes.io/part-of: activity-core
     spec:
+      securityContext:
+        runAsUser: 1000
+        runAsGroup: 1000
+        fsGroup: 1000
       containers:
         - name: worker
           image: activity-core:railiance01-prod
@@ -1051,8 +1055,9 @@ spec:
           configMap:
             name: actcore-ops-service-inventory
         - name: working-memory
-          persistentVolumeClaim:
-            claimName: actcore-working-memory
+          hostPath:
+            path: /home/tegwick/the-custodian/memory/working
+            type: DirectoryOrCreate
         - name: custodian-runtime
           configMap:
             name: actcore-custodian-runtime