fix(sandbox): add missing PodSecurity restricted:latest fields

Sandbox pods for analysis/execution fail to start on clusters
enforcing the restricted Pod Security Standard (default for
openshift-* namespaces). Add runAsNonRoot and seccompProfile
at both pod and container level in podspec_builder.go and
bootstrap.go, matching the pattern already used by the console
plugin reconciler.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: jrangelramos

controller/proposal/podspec_builder.go

@@ -51,7 +51,9 @@ func (b *PodSpecBuilder) Build(
 		}},
 		SecurityContext: &corev1.SecurityContext{
 			AllowPrivilegeEscalation: ptr.To(false),
+			RunAsNonRoot:             ptr.To(true),
 			Capabilities:             &corev1.Capabilities{Drop: []corev1.Capability{"ALL"}},
+			SeccompProfile:           &corev1.SeccompProfile{Type: corev1.SeccompProfileTypeRuntimeDefault},
 		},
 	}
 
@@ -124,8 +126,12 @@ func (b *PodSpecBuilder) Build(
 	return &corev1.PodSpec{
 		ServiceAccountName:           serviceAccount,
 		AutomountServiceAccountToken: ptr.To(true),
-		Containers:                   []corev1.Container{container},
-		Volumes:                      volumes,
+		SecurityContext: &corev1.PodSecurityContext{
+			RunAsNonRoot:   ptr.To(true),
+			SeccompProfile: &corev1.SeccompProfile{Type: corev1.SeccompProfileTypeRuntimeDefault},
+		},
+		Containers: []corev1.Container{container},
+		Volumes:    volumes,
 	}, nil
 }
 

controller/sandbox/bootstrap.go

@@ -103,6 +103,12 @@ func ensureSandboxTemplate(ctx context.Context, c client.Client, image, namespac
 					"spec": map[string]any{
 						"serviceAccountName":           templateName,
 						"automountServiceAccountToken": false,
+						"securityContext": map[string]any{
+							"runAsNonRoot": true,
+							"seccompProfile": map[string]any{
+								"type": "RuntimeDefault",
+							},
+						},
 						"containers": []any{
 							map[string]any{
 								"name":  "agent",
@@ -116,9 +122,13 @@ func ensureSandboxTemplate(ctx context.Context, c client.Client, image, namespac
 								},
 								"securityContext": map[string]any{
 									"allowPrivilegeEscalation": false,
+									"runAsNonRoot":             true,
 									"capabilities": map[string]any{
 										"drop": []any{"ALL"},
 									},
+									"seccompProfile": map[string]any{
+										"type": "RuntimeDefault",
+									},
 								},
 							},
 						},