Deploy Intranet SEC-5 non-root image to GX10

Pin localhost/fc-intranet-web:v20260617-sec5-intranet-1abdf90 and apply restricted pod/container security contexts plus writable /data, /tmp, and /app/logs mounts.

apps-gx10/intranet/deployment-intranet-web.json

@@ -53,6 +53,10 @@
                 "name": "PageReadingOverrides__DatabasePath",
                 "value": "/data/page-reading-overrides.db"
               },
+              {
+                "name": "FlowerCore__Theme__DatabasePath",
+                "value": "/data/intranet-theme.db"
+              },
               {
                 "name": "KnowledgeFleetSearch__BaseUrl",
                 "value": "https://knowledge.iamworkin.lan"
@@ -78,8 +82,17 @@
                 }
               }
             ],
-            "image": "localhost/fc-intranet-web:gx10-v1",
+            "image": "localhost/fc-intranet-web:v20260617-sec5-intranet-1abdf90",
             "imagePullPolicy": "Never",
+            "securityContext": {
+              "allowPrivilegeEscalation": false,
+              "capabilities": {
+                "drop": [
+                  "ALL"
+                ]
+              },
+              "readOnlyRootFilesystem": true
+            },
             "livenessProbe": {
               "failureThreshold": 3,
               "httpGet": {
@@ -133,6 +146,14 @@
                 "mountPath": "/srv/flowercore-notes",
                 "name": "notes-corpus",
                 "readOnly": true
+              },
+              {
+                "mountPath": "/tmp",
+                "name": "temp"
+              },
+              {
+                "mountPath": "/app/logs",
+                "name": "logs"
               }
             ]
           }
@@ -140,7 +161,13 @@
         "dnsPolicy": "ClusterFirst",
         "restartPolicy": "Always",
         "schedulerName": "default-scheduler",
-        "securityContext": {},
+        "securityContext": {
+          "fsGroup": 1654,
+          "fsGroupChangePolicy": "OnRootMismatch",
+          "runAsGroup": 1654,
+          "runAsNonRoot": true,
+          "runAsUser": 1654
+        },
         "terminationGracePeriodSeconds": 30,
         "volumes": [
           {
@@ -152,6 +179,14 @@
           {
             "emptyDir": {},
             "name": "notes-corpus"
+          },
+          {
+            "emptyDir": {},
+            "name": "temp"
+          },
+          {
+            "emptyDir": {},
+            "name": "logs"
           }
         ]
       }