feat: deploy to Frostmoln production

Replace the AWS deploy-prod job (failing since CI left AWS) with deploy-prod-frostmoln, and run under the restricted Pod Security profile with the namespace's oci-registry pull secret.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01H6eVuR4Yt3m7TbDTDwyZJi

k8s/deploy.yaml

@@ -11,8 +11,19 @@ spec:
     spec:
       template:
         spec:
+          imagePullSecrets:
+            - name: oci-registry
+          securityContext:
+            runAsNonRoot: true
+            runAsUser: 65534
+            seccompProfile:
+              type: RuntimeDefault
           containers:
             - name: dancefetcher
+              securityContext:
+                allowPrivilegeEscalation: false
+                capabilities:
+                  drop: ["ALL"]
               image: ${IMAGE}
               imagePullPolicy: Always
               resources: