fix(helm): add pod-level security context support to QueryDoc deployment

[opspawn]

Summary

Fixes #1184 — QueryDoc helm template now supports pod-level security contexts via the podSecurityContext value.

Problem

Users running PSA (Pod Security Admission) in restricted mode need to set pod-level security contexts (e.g., runAsNonRoot, fsGroup, seccompProfile). The QueryDoc deployment template only supported container-level securityContext but not pod-level securityContext.

Changes

• values.yaml: Added podSecurityContext: {} default value
• deployment.yaml: Added conditional pod-level securityContext block under spec.template.spec
• deployment_test.yaml: Added two test cases (default empty + custom values)

Usage

podSecurityContext:
  runAsNonRoot: true
  fsGroup: 1000
  seccompProfile:
    type: RuntimeDefault

This follows the same pattern used in the main kagent controller and UI deployments.

Signed-off-by: opspawn agent@opspawn.com

[Copilot]

Pull request overview

Adds pod-level security context support to the QueryDoc Helm chart to help users comply with Kubernetes Pod Security Admission (restricted) requirements.

Changes:

• Add podSecurityContext: {} to the QueryDoc chart default values.
• Render spec.template.spec.securityContext from .Values.podSecurityContext when provided.
• Add helm-unittest coverage for default behavior (absent) and custom pod security context values.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated no comments.

File	Description
helm/tools/querydoc/values.yaml	Introduces podSecurityContext value to configure pod-level security context.
helm/tools/querydoc/templates/deployment.yaml	Conditionally renders pod securityContext from podSecurityContext.
helm/tools/querydoc/tests/deployment_test.yaml	Adds tests ensuring pod security context is omitted by default and set when configured.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.