fix: remediate 3 VlamGuard policy failures

[github-actions]

Summary

The manifests for the production deployment are well-hardened with strong security practices like read-only root filesystems, non-root execution, and dropped capabilities. However, two medium-severity issues require attention: explicitly disabling service account token automount (security best practice) and using a fully qualified image registry path (supply chain security). Addressing these will further reduce attack surface and improve image provenance tracking.

VlamGuard Report

	Risk Score	Risk Level	Grade	Hard Blocks
Before	30/100	low	C	0
After	30/100	low	C	0

Fixes Applied

Check ID	File	Description
service_account_token	demo/charts/hardened/values.yaml	Applied static remediation: automountServiceAccountToken

Unfixed (Manual Action Required)

• image_registry_allowlist
• container_port_name

Related Issue

Closes #22

---

Generated by VlamGuard