security(kubescape): set fsGroup on the five non-root CronJobs in C-0211's residual #4211

🤖 Generated by the Agentic Engineer

Evidence

On 2026-09-26, 19 of the 38 C-0211-scanned workloads still missed a pod-level fsGroup in their stored spec (#3522). Measured read-only against live prod.

Five of them already run as non-root user 65532 and lack only fsGroup: four Coroot housekeeping CronJobs and the Longhorn stale-node-cleanup CronJob. The sibling Coroot CronJob crossplane-sync-alerter already sets fsGroup: 65532.

Hypothesis

Setting fsGroup: 65532 at source on those five moves them out of C-0211's fsGroup gap, with no runtime effect beyond volume group ownership for a job that already runs as that uid. The residual blocking the narrowing in #3522 drops from 19 to 14.

Acceptance criteria

• The five CronJob templates carry pod-level fsGroup: 65532.
• After deploy, a read-only read of the prod stored specs shows the field on all five, and the next scheduled run of each succeeds.