Pod Security Standards — Reject Privileged Workloads at Admission Time

Day 13 fixed who can talk to the cluster. Day 14 fixes what can run in it. Pod Security Standards is the built-in admission controller that replaces the deprecated PodSecurityPolicy — turn it on per-namespace with one label, and a Pod that asks for `privileged: true` or runs as root is rejected by the API server before it ever lands on a node. Switch the webapp to the unprivileged nginx image, lock down every Pod field PSS cares about, then watch a deliberately-bad Pod get refused in real time.