ci(hermes): permit WebUI test package setup

ci/Jenkinsfile.hermes-webui-image

@@ -59,8 +59,9 @@ spec:
         allowPrivilegeEscalation: false
         capabilities:
           drop: ["ALL"]
-        runAsNonRoot: true
-        runAsUser: 1000
+          add: ["CHOWN", "FOWNER", "DAC_OVERRIDE", "SETGID", "SETUID"]
+        runAsNonRoot: false
+        runAsUser: 0
         seccompProfile:
           type: RuntimeDefault
       resources:

testing/tests/test_hermes_webui_release.py

@@ -137,6 +137,16 @@ def test_pipeline_builds_exact_reviewed_anchor_from_main() -> None:
     assert spec["enableServiceLinks"] is False
     containers = {item["name"]: item for item in spec["containers"]}
     assert "kaniko" in containers
+    python_security = containers["python"]["securityContext"]
+    assert python_security["runAsUser"] == 0
+    assert python_security["runAsNonRoot"] is False
+    assert set(python_security["capabilities"]["add"]) == {
+        "CHOWN",
+        "FOWNER",
+        "DAC_OVERRIDE",
+        "SETGID",
+        "SETUID",
+    }
     assert containers["kaniko"]["resources"]["requests"]["ephemeral-storage"] == "10Gi"
     assert containers["kaniko"]["resources"]["limits"]["ephemeral-storage"] == "20Gi"
     assert spec["nodeSelector"] == {"kubernetes.io/arch": "arm64"}