api | charts | docs: label unbind-system privileged for pod security

[bbedward]

Nothing sets a Pod Security level on unbind-system. Helmfile creates it implicitly (createNamespace: true). On clusters that enforce baseline by default, Talos on banano among them, the platform's own pods are rejected:

• buildkit: privileged and seccompProfile: Unconfined
• node-exporter, from victoria-metrics-k8s-stack: host network, host PID and host paths
• alloy: the /var/log host path

Fix:

• Fresh installs: a presync hook on those three releases creates the namespace if needed and labels it pod-security.kubernetes.io/enforce: privileged when it has no level yet. Written once as a YAML anchor. It is safe to run concurrently: create tolerates an existing namespace, and the label is only written when empty.
• Existing installs: the updater never runs helmfile (deploy/releases/README.md), so the API sets the same label on its own namespace at startup, only when missing. The API service account already has patch on namespaces (sa.yaml).

Backwards compatibility:

• A level an admin already set is never overwritten. banano keeps its hand-set label.
• Labels only affect pod creation; running pods are never evicted.
• On k3s installs this changes nothing in practice. The installer passes no PSA admission config; I believe Kubernetes enforces nothing without one, but I haven't checked this on k3s.
• No change under deploy/charts/charts/, CRDs or RBAC, so the release guard needs no deploy/releases/ dir.

Team namespaces are left alone on purpose:

• Enforcing baseline there would close the hole where team editors can create privileged pods with their kubeconfig (rbac_manager.go).
• It would also stop the gluetun and wireguard templates (NET_ADMIN, SYS_MODULE) on existing k3s installs.
• That needs its own decision and issue.

Docs: a Pod Security note in Bring Your Own Kubernetes, and the chart README.

Tests: TestEnsurePrivilegedNamespace (fake clientset) covers adding the label, keeping an existing level, and an unlabeled namespace. helmfile build renders the hook on all three releases. The jsonpath check was tried with kubectl --local against labeled and bare namespaces. The hook has not run against a live cluster.

fixes UNB-408