security(cilium): give Hubble relay and UI the two C-0211 defaults #4090

🤖 Generated by the Agentic Engineer

Evidence

The 2026-09-23 re-measurement on #3239 found 8 controllers in kube-system still missing the two non-privilege C-0211 defaults. Six come from the Cilium HelmRelease. Two of them, hubble-relay and hubble-ui, are off the data path.

Change

Set fsGroupChangePolicy: OnRootMismatch on both pods and an empty seLinuxOptions on every container, using chart values. Helm merges these into the chart's own security defaults, so no privilege, user or group field changes.

Acceptance criteria

• A render test on the pinned chart proves that both Deployments carry the two fields, that the chart's own hardening is kept, and that nothing else in the render changes.
• After rollout, both live Deployments carry the fields and their pods are Ready.

Size: small. The Cilium agent, operator, Envoy and the certgen CronJob come in later slices.

Part of #3239