Function hardened_pod_security_context 

pub fn hardened_pod_security_context() -> PodSecurityContext

The restricted-PSA-compatible hardened pod security context — the pod-level peer of hardened_security_context. Defaults fsGroup to MOVER_NONROOT_ID so every mover pod’s volumes (notably the cache) are writable by the unprivileged mover; fsGroupChangePolicy: OnRootMismatch skips the recursive chown when the volume root already matches, so it does not needlessly rewrite ownership on every run.

Same merge story as the container context (ADR-0004 §2): this is the LOWEST layer, overlaid field-wise by repo.moverDefaults.podSecurityContext then the recipe’s mover.podSecurityContext, so any of fsGroup/runAsUser/… can be overridden (e.g. a restore that must own files as the app’s UID) while unset fields keep the hardened default. Lives in api so the webhook and controller resolve it identically.