fix: remediate 9 VlamGuard policy failures

[github-actions]

Summary

{"description": "The Deployment clean-deploy in the production namespace has several critical security gaps that require immediate attention, including missing read-only root filesystem, unconfigured user/group IDs, and privilege escalation risks. Addressing these will significantly harden the workload against container breakout attacks and improve operational reliability. The deployment also lacks high-availability best practices like pod anti-affinity and health probes.", "action_required": true}

VlamGuard Report

	Risk Score	Risk Level	Grade	Hard Blocks
Before	100/100	critical	C	3
After	100/100	critical	C	3

Fixes Applied

Check ID	File	Description
readonly_root_fs	demo/charts/clean-deploy/values.yaml	Applied static remediation: readOnlyRootFilesystem
service_account_token	demo/charts/clean-deploy/values.yaml	Applied static remediation: automountServiceAccountToken
allow_privilege_escalation	demo/charts/clean-deploy/values.yaml	Applied static remediation: allowPrivilegeEscalation

Unfixed (Manual Action Required)

• run_as_user_group
• liveness_readiness_probes
• host_pod_anti_affinity
• image_pull_policy
• drop_all_capabilities
• image_registry_allowlist

Related Issue

Closes #47

---

Generated by VlamGuard