deploy-configmap.sh: sandbox PodSpec missing restricted security context

[thoraxe]

Summary

hack/quickstart/deploy-configmap.sh (introduced in #395) generates a sandbox-pod-spec JSON with no security context. On any cluster where the openshift-lightspeed namespace enforces PSA restricted:latest, the operator fails to create analysis/execution/verification pods with:

pods "ls-analysis-..." is forbidden: violates PodSecurity "restricted:latest":
allowPrivilegeEscalation != false (container "agent" must set securityContext.allowPrivilegeEscalation=false),
unrestricted capabilities (container "agent" must set securityContext.capabilities.drop=["ALL"]),
runAsNonRoot != true (pod or container "agent" must set securityContext.runAsNonRoot=true),
seccompProfile (pod or container "agent" must set securityContext.seccompProfile.type to "RuntimeDefault" or "Localhost")

Root cause

Line 45 of deploy-configmap.sh generates:

{"containers":[{"name":"agent","image":"...","resources":{...}}]}

No securityContext at pod or container level.

The same issue exists in .tekton/integration-tests/scripts/install-operator.sh (the e2e equivalent). E2E tests pass because Konflux ephemeral clusters don't enforce restricted on the namespace.

Fix

Add the required restricted-compliant security context to the PodSpec JSON in both scripts:

Pod level:

"securityContext": {"runAsNonRoot": true, "seccompProfile": {"type": "RuntimeDefault"}}

Container level:

"securityContext": {"allowPrivilegeEscalation": false, "runAsNonRoot": true, "capabilities": {"drop": ["ALL"]}, "seccompProfile": {"type": "RuntimeDefault"}}

The reference security context is already documented in test/agent/sandboxtemplate/sandboxtemplate.yaml.

Regression

Introduced by #395.