Fix alloy singleton security context

General MR

Summary

Fix alloy singleton security context

Relevant logs/screenshots

(Include any relevant logs/screenshots)

Linked Issue

Closes #157 (closed)

Upgrade Notices

When alloy-singleton is enabled, this release now applies non-root, PSS Restricted-compatible security contexts to the Alloy and config-reloader containers by default. No configuration changes are required. The singleton remains disabled by default. Consumers with explicit security-context overrides should verify that those overrides remain compatible with their cluster policy.