fix(k8s): set fsGroup on pods with volumes

A freshly provisioned PVC mounts root:root, so any image that drops privileges
cannot write to it. docs-mcp-server runs as uid 1000 and died on first start
with SQLITE_CANTOPEN; its own Dockerfile says to chown the volume 1000:1000.

Pods with volumes now carry securityContext.fsGroup, defaulting to 1000 and
overridable per volume. fsGroupChangePolicy is OnRootMismatch so Kubernetes
does not walk and re-chown the whole volume on every start.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017BMXdb2qZbPSh8Q7XpTyjB

README.md

@@ -776,6 +776,10 @@ Notes:
 - Claims are `ReadWriteOnce`, so a server with volumes is limited to one
   replica. Asking for more is rejected at validation rather than leaving the
   extra replicas unschedulable.
+- A fresh claim mounts `root:root`, so mcpctl sets the pod's `fsGroup` to
+  **1000** — the conventional non-root uid in node/python images. Override with
+  `fsGroup` on the volume if an image uses a different one; containers running
+  as root are unaffected either way.
 - `storageClass` defaults to `MCPD_VOLUME_STORAGE_CLASS`, and is omitted
   entirely when neither is set. **Set it explicitly on any cluster with more
   than one default StorageClass**, where an omitted class binds