fix: remediate 9 VlamGuard policy failures

[github-actions]

Summary

The Deployment clean-deploy in the production namespace requires critical security hardening to mitigate privilege escalation risks, enforce least-privilege principles, and improve reliability. Key issues include missing read-only root filesystem, unconfigured user/group IDs, and lack of liveness/readiness probes. Addressing these will reduce attack surface and improve operational resilience in production.

VlamGuard Report

	Risk Score	Risk Level	Grade	Hard Blocks
Before	100/100	critical	C	3
After	100/100	critical	C	3

Fixes Applied

Check ID	File	Description
readonly_root_fs	demo/charts/clean-deploy/values.yaml	Applied static remediation: readOnlyRootFilesystem
service_account_token	demo/charts/clean-deploy/values.yaml	Applied static remediation: automountServiceAccountToken
allow_privilege_escalation	demo/charts/clean-deploy/values.yaml	Applied static remediation: allowPrivilegeEscalation

Unfixed (Manual Action Required)

• run_as_user_group
• liveness_readiness_probes
• host_pod_anti_affinity
• image_pull_policy
• drop_all_capabilities
• image_registry_allowlist

Related Issue

Closes #39

---

Generated by VlamGuard