054a2b9b44
- add configurable /dev/shm mounts for instance pods with a bounded SHM_SIZE_GB override - introduce pod security modes and use chromium-compat for OpenClaw instead of privileged - keep privileged mode only as an explicit admin fallback - remove the node-level clawmanager-node-tuner manifest to avoid changing host security defaults - fix k3s HTTPS and API/proxy service port mappings - add tests for SHM parsing and pod security mode behavior