fix(agent): grant worker mounted transport access

apps/api/tests/test_signal_worker_ansible_executor_binding.py

@@ -22,6 +22,7 @@ def test_worker_manifest_mounts_existing_ssh_mcp_transport() -> None:
 
     assert 'command: ["python", "-m", "src.workers.signal_worker"]' in manifest
     assert "serviceAccountName: awoooi-executor" in manifest
+    assert "fsGroup: 1000" in manifest
     assert "ENABLE_AWOOOP_ANSIBLE_CHECK_MODE_WORKER" in manifest
     assert "ENABLE_AWOOOP_ANSIBLE_CONTROLLED_APPLY" in manifest
     assert "AWOOOP_ANSIBLE_CHECK_MODE_STARTUP_SLEEP_SECONDS" in manifest

k8s/awoooi-prod/08-deployment-worker.yaml

@@ -44,6 +44,8 @@ spec:
         environment: prod
         component: signal-processor
     spec:
+      securityContext:
+        fsGroup: 1000
       # 2026-07-01 Codex: keep hostname spread as a preference, not a hard
       # scheduler blocker, so reboot recovery and GitOps rollouts do not deadlock.
       topologySpreadConstraints: