[iris/CW] Add SYS_PTRACE to controller pod for profiling on K8s

[ravwojdyla-agent]

Describe the bug

iris process profile threads and iris process profile mem fail on the K8s controller with Permission denied (os error 13). py-spy and memray both require ptrace, which is blocked by the controller pod's security context.

Error: Profiling failed: py-spy dump failed: Error: Permission denied (os error 13)

Task pods have SYS_PTRACE in their security context (tasks.py:395), but the controller Deployment does not (controller.py:_build_controller_deployment).

To Reproduce

1. Deploy Iris on CoreWeave K8s.
2. Run uv run iris process profile threads or uv run iris process profile mem.
3. Observe: Permission denied (os error 13).

Expected behavior

Profiling should work on the controller pod, same as it does on task pods.

Additional context

Fix: add SYS_PTRACE capability to the controller container spec in _build_controller_deployment (controller.py:163):

"securityContext": {"capabilities": {"add": ["SYS_PTRACE"]}},

Task pods already have this at tasks.py:395-398.

[ravwojdyla]

@claude pretty please follow @docs/recipes/fix_issue.md 🙇

[claude]

Claude finished @ravwojdyla's task in 3m 56s —— View job • claude/issue-4416-20260404-0352 • Create PR ➔

---

Fixing: Add SYS_PTRACE to controller pod for profiling on K8s

• Read fix_issue recipe and gather context
• Read relevant source files (controller.py, tasks.py)
• Implement the fix
• Run lint and tests
• Commit and push

Summary

Added SYS_PTRACE capability to the controller container's securityContext in _build_controller_deployment (controller.py:178), matching what task pods already have (tasks.py:394-398). This allows iris process profile threads and iris process profile mem to work on the controller pod.

Changes:

• lib/iris/src/iris/cluster/providers/k8s/controller.py — added "securityContext": {"capabilities": {"add": ["SYS_PTRACE"]}} to the controller container spec
• lib/iris/tests/cluster/providers/k8s/test_coreweave.py — added test_controller_deployment_has_sys_ptrace test

Testing: ./infra/pre-commit.py --all-files --fix passed ✅ and pytest test_coreweave.py -k test_controller_deployment (2 tests) passed ✅

·