feat: complete cluster self-sufficiency hardening

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a06d83-1cbc-71f2-b0dc-e0f48cedae43

deploy/railiance/apps/charts/state-hub/values.yaml

@@ -162,14 +162,29 @@ probes:
     timeoutSeconds: 5
     failureThreshold: 3
 
-podSecurityContext: {}
-securityContext: {}
+# STATE-WP-0081-T04. The image and all writable runtime state are independent
+# of root. Keep these defaults restrictive so API, MCP, and migration pods have
+# the same security posture in every installation.
+podSecurityContext:
+  runAsNonRoot: true
+  runAsUser: 10001
+  runAsGroup: 10001
+  fsGroup: 10001
+  seccompProfile:
+    type: RuntimeDefault
+securityContext:
+  allowPrivilegeEscalation: false
+  capabilities:
+    drop:
+      - ALL
+  readOnlyRootFilesystem: true
 
 nodeSelector: {}
 tolerations: []
 affinity: {}
 
-# Consistency sweep: mount railiance01 clone tree and match host_paths hostname.
+# Legacy consistency sweep settings. Kept only for rollback compatibility;
+# production uses Forge-derived reconciliation and must leave this disabled.
 sweep:
   enabled: false
   hostname: ""