fix(stand): label blockstor-system as privileged PSA namespace

Without this label kube-apiserver's default Restricted PodSecurity
profile rejected the satellite DaemonSet (privileged + hostPath +
hostPort + hostNetwork). The test stand had this set out of band so
it Just Worked there; new stands need it explicit.

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Andrei Kvapil <kvapss@gmail.com>

Author: kvaps

stand/blockstor-deploy.yaml

@@ -7,6 +7,14 @@ apiVersion: v1
 kind: Namespace
 metadata:
   name: blockstor-system
+  labels:
+    # The satellite is privileged + hostNetwork + hostPID + hostPath —
+    # required for drbdadm / losetup / cryptsetup against the kernel.
+    # The default PodSecurity Restricted profile rejects all of these,
+    # so explicitly opt this namespace into the privileged profile.
+    pod-security.kubernetes.io/enforce: privileged
+    pod-security.kubernetes.io/audit: privileged
+    pod-security.kubernetes.io/warn: privileged
 ---
 apiVersion: v1
 kind: ServiceAccount