apiVersion: v1
kind: Namespace
metadata:
  name: gitea
  labels:
    # act_runner DinD sidecar requires privileged; relax PSA enforce for this ns
    pod-security.kubernetes.io/enforce: privileged