Harden prod: security, autoscaling, observability, BuildKit CI

Security:
- Drop ALL capabilities, enforce non-root, RuntimeDefault seccomp on
  neuron-mcp, neuron-rest, neuron-marketing pods
- Add startup probes (150s window for JVM) so liveness doesn't fire early
- Replace docker-sock hostPath with BuildKit rootless TCP endpoint
  (moby/buildkit:v0.19.0-rootless) — removes node root access from CI
- Document full ESO AppRole migration path in cluster-secret-store.yaml

Autoscaling & availability:
- HPAs on mcp (1–6), rest (1–4), marketing (2–8) at 65–70% CPU
- PodDisruptionBudgets (minAvailable: 1) on all three services
- NetworkPolicy: default-deny-all in neuron-prod, explicit allow rules
  for Traefik ingress, intra-namespace, and egress to DNS/platform/vault

Observability:
- ServiceMonitors for mcp, rest, marketing (cross-namespace enabled in
  kube-prometheus-stack with serviceMonitorSelectorNilUsesHelmValues:false)
- PrometheusRules: high error rate, high latency, crash loops, replica
  shortage, Postgres down/connections, backup failure, backup staleness

Chart version pinning:
- kube-prometheus-stack, loki, tempo, redis, alloy, postgres — all pinned
  to major-version ranges to block silent breaking upgrades

Backup hardening:
- restic:latest → restic:0.17.3 (deterministic image)
- Weekly backup-verify CronJob: restores latest snapshot and validates
  SQL dump structure (≥5 CREATE TABLE, pg_dump header check)

ArgoCD:
- neuron-prod AppProject: scopes deploys to neuron-prod + platform ns,
  blacklists ClusterRole/ClusterRoleBinding/Namespace creation,
  automated sync window 2–6am UTC, manual always allowed

servers/legion/apps/gitea-runner.yaml

@@ -1,3 +1,7 @@
+---
+# Gitea CI runner — general-purpose (legion)
+# Docker socket REMOVED. Builds go through buildkitd TCP endpoint.
+# Set DOCKER_HOST=tcp://buildkitd.ci.svc.cluster.local:1234 in build steps.
 apiVersion: apps/v1
 kind: Deployment
 metadata:
@@ -15,8 +19,10 @@ spec:
       labels:
         app: gitea-runner
       annotations:
-        config-version: "2026-04-23-nodeport-url"
+        config-version: "2026-04-25-buildkit-no-sock"
     spec:
+      securityContext:
+        runAsNonRoot: false  # act_runner needs root for container management
       initContainers:
         - name: register
           image: registry.neuralplatform.ai/ci-base:latest
@@ -36,10 +42,9 @@ spec:
                 timeout: 3h
               container:
                 network: host
-                docker_host: "unix:///var/run/docker.sock"
+                docker_host: "tcp://buildkitd.ci.svc.cluster.local:1234"
                 force_pull: false
-                valid_volumes:
-                  - /var/run/docker.sock
+                valid_volumes: []
                 default_image: "registry.neuralplatform.ai/ci-base:latest"
                 extra_hosts:
                   - "gitea.git.svc.cluster.local:10.43.1.53"
@@ -55,14 +60,16 @@ spec:
           image: registry.neuralplatform.ai/ci-base:latest
           workingDir: /data
           command: ["act_runner", "daemon", "--config", "/data/config.yaml"]
+          env:
+            - name: DOCKER_HOST
+              value: "tcp://buildkitd.ci.svc.cluster.local:1234"
           envFrom:
             - secretRef:
                 name: gitea-runner-secret
           volumeMounts:
             - name: data
               mountPath: /data
-            - name: docker-sock
-              mountPath: /var/run/docker.sock
+          # docker-sock volume intentionally removed — use buildkitd TCP instead
           resources:
             requests:
               memory: 512Mi
@@ -73,11 +80,9 @@ spec:
       volumes:
         - name: data
           emptyDir: {}
-        - name: docker-sock
-          hostPath:
-            path: /var/run/docker.sock
-            type: Socket
+        # docker-sock hostPath intentionally removed
 ---
+# Neuron Technologies CI runner
 apiVersion: apps/v1
 kind: Deployment
 metadata:
@@ -95,7 +100,7 @@ spec:
       labels:
         app: neuron-technologies-runner
       annotations:
-        config-version: "2026-04-24-initial"
+        config-version: "2026-04-25-buildkit-no-sock"
     spec:
       initContainers:
         - name: register
@@ -116,10 +121,9 @@ spec:
                 timeout: 3h
               container:
                 network: host
-                docker_host: "unix:///var/run/docker.sock"
+                docker_host: "tcp://buildkitd.ci.svc.cluster.local:1234"
                 force_pull: false
-                valid_volumes:
-                  - /var/run/docker.sock
+                valid_volumes: []
                 default_image: "registry.neuralplatform.ai/ci-base:latest"
                 extra_hosts:
                   - "gitea.git.svc.cluster.local:10.43.1.53"
@@ -135,14 +139,15 @@ spec:
           image: registry.neuralplatform.ai/ci-base:latest
           workingDir: /data
           command: ["act_runner", "daemon", "--config", "/data/config.yaml"]
+          env:
+            - name: DOCKER_HOST
+              value: "tcp://buildkitd.ci.svc.cluster.local:1234"
           envFrom:
             - secretRef:
                 name: neuron-technologies-runner-secret
           volumeMounts:
             - name: data
               mountPath: /data
-            - name: docker-sock
-              mountPath: /var/run/docker.sock
           resources:
             requests:
               memory: 512Mi
@@ -153,7 +158,3 @@ spec:
       volumes:
         - name: data
           emptyDir: {}
-        - name: docker-sock
-          hostPath:
-            path: /var/run/docker.sock
-            type: Socket