fix: remediate 3 VlamGuard policy failures

[github-actions]

Summary

The provided Kubernetes manifests for the production environment demonstrate strong security practices, including proper security contexts, resource limits, and network policies. However, two medium-severity issues require attention: explicitly disabling service account token automount and using fully qualified image names. Addressing these will further harden the deployment against privilege escalation and supply chain risks.

The Deployment is well-configured with read-only root filesystems, non-root execution, and dropped capabilities, but minor improvements like naming container ports would enhance maintainability.

VlamGuard Report

	Risk Score	Risk Level	Grade	Hard Blocks
Before	30/100	low	C	0
After	30/100	low	C	0

Fixes Applied

Check ID	File	Description
service_account_token	demo/charts/hardened/values.yaml	Applied static remediation: automountServiceAccountToken

Unfixed (Manual Action Required)

• image_registry_allowlist
• container_port_name

Related Issue

Closes #51

---

Generated by VlamGuard