[lab] fix(k8s): fsGroup/non-root no overlay de lab p/ imagem uid 10001

A imagem passou a rodar non-root (uid/gid 10001), mas o overlay de lab não
tinha securityContext/fsGroup — os dirs do PVC (chroma_db, data_storage)
ficavam root:root e a escrita do ChromaDB/CSV falhava com Permission denied
(pod subia e /health respondia, mas query quebraria). Alinha o lab ao hml:
- pod securityContext runAsNonRoot + runAsUser/Group/fsGroup 10001
- container: allowPrivilegeEscalation:false, drop ALL
- HOME=/home/app e cache ONNX montado em /home/app/.cache/chroma

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

k8s/lab/deployment.yaml

@@ -16,14 +16,28 @@ spec:
       labels:
         app: vanna-clubpetro
     spec:
+      # A imagem roda como non-root (uid/gid 10001). fsGroup dá posse dos
+      # volumes (PVC) ao grupo 10001 pra que o processo consiga escrever no
+      # store/cache — sem isso o ChromaDB/CSV falha com Permission denied.
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 10001
+        runAsGroup: 10001
+        fsGroup: 10001
       containers:
         - name: vanna-clubpetro
           image: us-central1-docker.pkg.dev/corepetro/clubpetro-lab/vanna-clubpetro:lab-latest
           imagePullPolicy: IfNotPresent
+          securityContext:
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop: ["ALL"]
           ports:
             - name: http
               containerPort: 8765
           env:
+            - name: HOME
+              value: /home/app
             - name: VANNA_CORS_ORIGINS
               value: "https://lab.clubpetro.com,https://homologation.clubpetro.com"
           envFrom:
@@ -57,7 +71,7 @@ spec:
               mountPath: /app/data_storage
               subPath: data_storage
             - name: data
-              mountPath: /root/.cache/chroma
+              mountPath: /home/app/.cache/chroma
               subPath: chroma-onnx-cache
       volumes:
         - name: data