fix: Databento download job — HOME=/tmp for pip, network policy label

Set HOME=/tmp to fix pip cache ownership, --no-cache-dir for clean install.
Label compile-and-train matches network policy for HTTPS egress.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

infra/k8s/jobs/databento-download.yaml

@@ -24,6 +24,7 @@ spec:
       labels:
         app.kubernetes.io/name: databento-download
         app.kubernetes.io/part-of: foxhunt
+        app.kubernetes.io/component: compile-and-train
     spec:
       restartPolicy: OnFailure
       securityContext:
@@ -44,18 +45,19 @@ spec:
                   key: api-key
           resources:
             requests:
+              cpu: 500m
+              memory: 1Gi
+            limits:
               cpu: "2"
               memory: 4Gi
-            limits:
-              cpu: "4"
-              memory: 8Gi
           volumeMounts:
             - name: training-data
               mountPath: /data
           args:
             - |
               set -e
-              pip install databento --quiet
+              export HOME=/tmp
+              pip install --no-cache-dir --break-system-packages databento
 
               python3 << 'PYEOF'
               import databento as db