fix(k8s): add runAsNonRoot:false to fetch-binary initContainers

Pod-level runAsNonRoot:true conflicts with initContainer runAsUser:0.
Kubernetes rejects the container. Add explicit override so the
initContainer can still run as root to fetch binaries from S3.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

infra/k8s/services/api-gateway.yaml

@@ -41,6 +41,7 @@ spec:
         - name: fetch-binary
           securityContext:
             runAsUser: 0
+            runAsNonRoot: false
           image: rg.fr-par.scw.cloud/foxhunt-ci/foxhunt-runtime:latest
           command: ["/bin/sh", "-c"]
           args:

infra/k8s/services/backtesting-service.yaml

@@ -41,6 +41,7 @@ spec:
         - name: fetch-binary
           securityContext:
             runAsUser: 0
+            runAsNonRoot: false
           image: rg.fr-par.scw.cloud/foxhunt-ci/foxhunt-runtime:latest
           command: ["/bin/sh", "-c"]
           args:

infra/k8s/services/broker-gateway.yaml

@@ -41,6 +41,7 @@ spec:
         - name: fetch-binary
           securityContext:
             runAsUser: 0
+            runAsNonRoot: false
           image: rg.fr-par.scw.cloud/foxhunt-ci/foxhunt-runtime:latest
           command: ["/bin/sh", "-c"]
           args:

infra/k8s/services/data-acquisition-service.yaml

@@ -41,6 +41,7 @@ spec:
         - name: fetch-binary
           securityContext:
             runAsUser: 0
+            runAsNonRoot: false
           image: rg.fr-par.scw.cloud/foxhunt-ci/foxhunt-runtime:latest
           command: ["/bin/sh", "-c"]
           args:

infra/k8s/services/ml-training-service-gpu.yaml

@@ -49,6 +49,7 @@ spec:
         - name: fetch-binary
           securityContext:
             runAsUser: 0
+            runAsNonRoot: false
           image: rg.fr-par.scw.cloud/foxhunt-ci/foxhunt-runtime:latest
           command: ["/bin/sh", "-c"]
           args:

infra/k8s/services/ml-training-service.yaml

@@ -84,6 +84,7 @@ spec:
         - name: fetch-binary
           securityContext:
             runAsUser: 0
+            runAsNonRoot: false
           image: rg.fr-par.scw.cloud/foxhunt-ci/foxhunt-runtime:latest
           command: ["/bin/sh", "-c"]
           args:

infra/k8s/services/trading-agent-service.yaml

@@ -41,6 +41,7 @@ spec:
         - name: fetch-binary
           securityContext:
             runAsUser: 0
+            runAsNonRoot: false
           image: rg.fr-par.scw.cloud/foxhunt-ci/foxhunt-runtime:latest
           command: ["/bin/sh", "-c"]
           args:

infra/k8s/services/trading-service-gpu.yaml

@@ -48,6 +48,7 @@ spec:
         - name: fetch-binary
           securityContext:
             runAsUser: 0
+            runAsNonRoot: false
           image: rg.fr-par.scw.cloud/foxhunt-ci/foxhunt-runtime:latest
           command: ["/bin/sh", "-c"]
           args:

infra/k8s/services/trading-service.yaml

@@ -41,6 +41,7 @@ spec:
         - name: fetch-binary
           securityContext:
             runAsUser: 0
+            runAsNonRoot: false
           image: rg.fr-par.scw.cloud/foxhunt-ci/foxhunt-runtime:latest
           command: ["/bin/sh", "-c"]
           args:

infra/k8s/services/web-gateway.yaml

@@ -41,6 +41,7 @@ spec:
         - name: fetch-binary
           securityContext:
             runAsUser: 0
+            runAsNonRoot: false
           image: rg.fr-par.scw.cloud/foxhunt-ci/foxhunt-runtime:latest
           command: ["/bin/sh", "-c"]
           args: