Support optional non-root transport trust installation

[nv-lacm]

Description

Support running the transport trust-bundle installer as non-root in Kubernetes namespaces that enforce the Restricted Pod Security Standard.

This is optional hardening. It is not required to complete PKI Epic #19 or the end-to-end validation in #52. The current installer behavior remains supported while this follow-up is open.

Definition of Done

• The optional non-root path makes the merged certificate volume writable by the nvca-trust-init user.
• That path does not require UID 0 or runAsNonRoot: false.
• Tests cover the current behavior and pods that already enforce a non-root security context.
• Restricted Pod Security validation passes when the optional path is selected.

Tracking

This issue is not a native sub-issue of #19 and does not gate epic closure.

[mikeyrcamp]

Scope decision: this issue is optional Restricted Pod Security hardening and is not required to complete PKI Epic #19. It has been removed from the epic native sub-issue hierarchy and remains open as follow-up work. The current root-based installer behavior remains supported until this optional non-root path is implemented and validated.