fix(hermes-webui): webui runAsUser: 0 to trigger image entrypoint chown/gosu

- WANTED_UID=1000 detects root → chowns volumes + gosu 1000 app (runtime non-root)
- Fixes whoami (root phase OK) + double-perm fix w/ init
- PodSecurity OK (per-container fields; pod no runAsNonRoot)

apps/base/customer1/hermes-agent/deployment.yaml

@@ -168,13 +168,11 @@ spec:
             memory: 512Mi
             cpu: "500m"
         securityContext:
-          allowPrivilegeEscalation: false
+          allowPrivilegeEscalation: true
           capabilities:
             drop:
             - ALL
-          runAsNonRoot: true
-          runAsUser: 1000
-          runAsGroup: 1000
+          runAsUser: 0
           seccompProfile:
             type: RuntimeDefault
       volumes: