[dcadolph]

Pod security predicates were written three times with three different precedence rules. The admission non-root check let a pod-level runAsNonRoot: true pass a container that set false, workloadsec read runAsNonRoot: false as root, a container's Unconfined seccomp profile under a pod RuntimeDefault read as confined, and the admission baseline counted unknown containers as non-root while the check flagged them.

This adds internal/podsec, the one place a pod security predicate is written, with Kubernetes precedence (container when set, else pod, else the documented default). Workloadsec, the security scanner, the admission checks, and the admission baseline all call it, and the old helpers are gone.

Behavior changes: runAsNonRoot: false alone is unknown, not root. A container under a pod runAsUser: 0 is root even with runAsNonRoot: true. Privileged containers and added SYS_ADMIN or ALL allow privilege escalation. A namespace with enforce: privileged counts as unenforced. Ephemeral containers are left out of the counts that feed the admission baseline.

New workload security fields: baseline_containers, run_as_non_root_containers, and run_as_unknown_containers (replaces unknown_root_containers). The baseline non-root, privilege escalation, and read-only fractions now use baseline_containers as the denominator, so scans stored before this change contribute nothing to them.

Tests: an 81-case pod-by-container root status matrix, seccomp and escalation matrices, and precedence cases in workloadsec and admission. The local gate (lint, race, cmd x10, browser, kind integration) is green.

Also locks the shared root command in TestScanFlagsDefined, which read its flags unlocked and raced TestBadFlagErrorShape under -count=10.