fix(hermes-webui): add initContainer root chown for PVC uid perms

- Removes pod runAsNonRoot/runAsUser to allow init runAsUser: 0
- chowns PVC to 1000:1000 + g+rwX (fixes legacy root-owned files)
- webui can now mkdir/write state dir
- whoami log non-fatal; runtime non-root

apps/base/customer1/hermes-agent/deployment.yaml

@@ -14,10 +14,23 @@ spec:
         app: hermes-agent
     spec:
       securityContext:
-        runAsNonRoot: true
-        runAsUser: 1000
         runAsGroup: 1000
         fsGroup: 1000
+      initContainers:
+      - name: fix-webui-perms
+        image: busybox:1.36
+        securityContext:
+          runAsUser: 0
+        command:
+          - sh
+          - -c
+        args:
+          - |
+            chown -R 1000:1000 /data
+            chmod -R g+rwX,o-rwx /data
+        volumeMounts:
+          - name: hermes-data
+            mountPath: /data
       containers:
       - name: hermes-agent
         securityContext: