Switch k8s-runner bootstrap default Docker implementation to privileged #501

User request\n\n1. Check whether our k8s implements privileged mode.\n2. If yes, switch it in bootstrap to privileged mode by default.\n\n## Spec (from architecture + repo inspection)\n\n- Architecture documents and k8s-runner implementation supports privileged Docker (DinD): sidecar with .\n- Bootstrap currently sets for k8s-runner (Terraform-generated Helm values).\n\n### Changes\n\n- In , change k8s-runner env default to (ideally via a Terraform variable with default , but keeping within this single intent).\n- Ensure workload namespace () allows privileged pods if Pod Security Admission is enabled by labeling the namespace in :\n - \n - (optionally) and \n\n### Acceptance\n\n- for affected stacks is clean except for intended changes.\n- After apply, k8s-runner deployment in has set to .\n- Workload pods created in can start with a privileged sidecar (no admission rejection due to PSA).\n