feat: deploy to Frostmoln production

Replace the AWS deploy-prod job (failing since CI left AWS) with deploy-prod-frostmoln, and run under the restricted Pod Security profile with the namespace's oci-registry pull secret.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01H6eVuR4Yt3m7TbDTDwyZJi

k8s/deploy.yaml

@@ -21,6 +21,13 @@ spec:
       labels:
         app.kubernetes.io/name: geo-service
     spec:
+      imagePullSecrets:
+        - name: oci-registry
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 65534
+        seccompProfile:
+          type: RuntimeDefault
       affinity:
         podAntiAffinity:
           preferredDuringSchedulingIgnoredDuringExecution:
@@ -35,6 +42,10 @@ spec:
                 topologyKey: kubernetes.io/hostname
       containers:
         - name: geo-service
+          securityContext:
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop: ["ALL"]
           resources:
             limits:
               memory: "100Mi"
@@ -43,8 +54,11 @@ spec:
           imagePullPolicy: Always
           image: ${IMAGE}
           ports:
-            - containerPort: 80
+            - containerPort: 8080
               name: http
+          env:
+            - name: PORT
+              value: "8080"
           envFrom:
             - secretRef:
                 name: geo-service
@@ -59,7 +73,7 @@ spec:
     - port: 80
       name: http
       protocol: TCP
-      targetPort: 80
+      targetPort: 8080
   selector:
     app.kubernetes.io/name: geo-service
   type: ClusterIP