- Removes pod runAsNonRoot/runAsUser to allow init runAsUser: 0 - chowns PVC to 1000:1000 + g+rwX (fixes legacy root-owned files) - webui can now mkdir/write state dir - whoami log non-fatal; runtime non-root