fix(argo): set fsGroup=0 for workspace PVC write access across steps

Without fsGroup, workspace PVC created by root-running compile step
is not writable by other steps. fsGroup=0 ensures all pods in the
workflow can write to the shared workspace volume.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

infra/k8s/argo/compile-and-train-template.yaml

@@ -24,8 +24,10 @@ spec:
     labels:
       app.kubernetes.io/part-of: foxhunt
       app.kubernetes.io/component: compile-and-train
-  # No pod-level securityContext — compile (ci-builder) and Kaniko need root,
-  # training steps (foxhunt-training-runtime) run as UID 1000 in the image.
+  # No runAsUser — compile (ci-builder) needs root, training runtime defaults
+  # to its image user. fsGroup ensures workspace PVC is writable by all pods.
+  securityContext:
+    fsGroup: 0
   ttlStrategy:
     secondsAfterCompletion: 3600
   activeDeadlineSeconds: 28800  # 8 hours (compile + full training)