fix(k8s/gitea): patch act_runner storageClassName and allow privileged DinD via PSA

kubernetes/app/gitea/namespace.yaml

@@ -2,3 +2,6 @@ apiVersion: v1
 kind: Namespace
 metadata:
   name: gitea
+  labels:
+    # act_runner DinD sidecar requires privileged; relax PSA enforce for this ns
+    pod-security.kubernetes.io/enforce: privileged

kubernetes/app/gitea/release-actions.yaml

@@ -23,13 +23,23 @@ spec:
       retries: 3
   dependsOn:
     - name: gitea
+  # chart 0.1.0 has a broken `global.storageClass` helper (extra newline breaks YAML),
+  # so we set storageClassName via a kustomize patch instead.
+  postRenderers:
+    - kustomize:
+        patches:
+          - target:
+              kind: StatefulSet
+              name: gitea-gitea-actions-act-runner
+            patch: |
+              - op: add
+                path: /spec/volumeClaimTemplates/0/spec/storageClassName
+                value: nfs-synology-ssd
   values:
     enabled: true
-    giteaRootURL: http://gitea-http.gitea.svc.cluster.local:3000
+    giteaRootURL: http://gitea-gitea-http.gitea.svc.cluster.local:3000
     existingSecret: gitea-runner-token
     existingSecretKey: token
-    global:
-      storageClass: nfs-synology-ssd
     statefulset:
       replicas: 1
       timezone: Europe/Kyiv