maintenance: document rpi reservation privileges

services/maintenance/rpi-resource-reservation-daemonset.yaml

@@ -17,7 +17,7 @@ spec:
       annotations:
         atlas.bstein.dev/reservation-revision: "2026-05-19-5"
     spec:
-      hostPID: true
+      hostPID: true # Needed for nsenter to run host systemd reloads after config writes.
       serviceAccountName: node-nofile
       nodeSelector:
         node-role.kubernetes.io/worker: "true"
@@ -57,7 +57,7 @@ spec:
               cpu: 100m
               memory: 96Mi
           securityContext:
-            privileged: true
+            privileged: true # Required to write host kubelet reservation files under /host.
             runAsUser: 0
           volumeMounts:
             - name: host-root