fix: set runAsNonRoot=false on SELinux relabel init container (#42)

The pod-level runAsNonRoot=true policy blocks the privileged init
container from running as root. Override it at the container level.

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: stubbi

internal/resources/statefulset.go

@@ -82,8 +82,9 @@ func BuildStatefulSet(instance *paperclipv1alpha1.Instance, extraPodAnnotations
 				{Name: DataVolumeName, MountPath: DataMountPath},
 			},
 			SecurityContext: &corev1.SecurityContext{
-				Privileged: Ptr(true),
-				RunAsUser:  Ptr(int64(0)),
+				Privileged:   Ptr(true),
+				RunAsUser:    Ptr(int64(0)),
+				RunAsNonRoot: Ptr(false),
 			},
 		})
 	}