Function hardened_security_context 

pub fn hardened_security_context() -> SecurityContext

The restricted-PSA-compatible hardened container security context (§4.11/G16): non-root, no privilege escalation, drop ALL caps, seccomp RuntimeDefault.

This is the LOWEST merge layer (ADR-0004 §2): repo.moverDefaults.securityContext then the recipe’s mover.securityContext overlay it field-wise, so a partial override can only tighten — it never drops capabilities.drop:[ALL] / seccompProfile. Lives in api (not the controller) so the webhook and controller share one definition and both resolve the effective mover context identically.