phase 16: custom superset image with trino driver, fix security context

infra/helm/stonks-oracle/templates/namespace.yaml

@@ -1,7 +0,0 @@
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: {{ .Release.Namespace }}
-  labels:
-    {{- include "stonks.labels" . | nindent 4 }}
-    kubernetes.io/metadata.name: {{ .Release.Namespace }}

infra/helm/stonks-oracle/templates/superset.yaml

@@ -25,10 +25,12 @@ spec:
         {{- toYaml . | nindent 8 }}
       {{- end }}
       securityContext:
-        {{- include "stonks.podSecurityContext" . | nindent 8 }}
+        runAsNonRoot: true
+        seccompProfile:
+          type: RuntimeDefault
       containers:
         - name: superset
-          image: apache/superset:latest
+          image: {{ .Values.image.registry }}/superset:{{ .Values.image.tag }}
           ports:
             - containerPort: 8088
           securityContext:

infra/migrations/014_retention_policies.sql

@@ -23,7 +23,8 @@ INSERT INTO retention_policies (bucket_name, artifact_class, retention_days, arc
     ('stonks-llm-prompts', 'default', 365, FALSE),
     ('stonks-llm-results', 'default', 365, FALSE),
     ('stonks-lakehouse',   'default', 730, FALSE),
-    ('stonks-audit',       'default', 730, FALSE);
+    ('stonks-audit',       'default', 730, FALSE)
+ON CONFLICT (bucket_name, artifact_class) DO NOTHING;
 
 -- Track retention cleanup runs for observability
 CREATE TABLE retention_runs (