fix(spark): add fsGroup 185 so spark user can write to PVCs

local-path PVCs are created root-owned. The apache/spark image runs as
spark (UID 185). fsGroup: 185 makes K8s chown the mounted volume to that
group on attach, fixing the mkdir IOException on /spark-checkpoint.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

spark-analytics/base/cronjobs.yaml

@@ -19,6 +19,8 @@ spec:
         spec:
           serviceAccountName: spark-analytics
           restartPolicy: OnFailure
+          securityContext:
+            fsGroup: 185
           imagePullSecrets:
             - name: ghcr-pull-secret
           containers:
@@ -91,6 +93,8 @@ spec:
         spec:
           serviceAccountName: spark-analytics
           restartPolicy: OnFailure
+          securityContext:
+            fsGroup: 185
           imagePullSecrets:
             - name: ghcr-pull-secret
           containers:
@@ -162,6 +166,8 @@ spec:
         spec:
           serviceAccountName: spark-analytics
           restartPolicy: OnFailure
+          securityContext:
+            fsGroup: 185
           imagePullSecrets:
             - name: ghcr-pull-secret
           containers:
@@ -234,6 +240,8 @@ spec:
         spec:
           serviceAccountName: spark-analytics
           restartPolicy: OnFailure
+          securityContext:
+            fsGroup: 185
           imagePullSecrets:
             - name: ghcr-pull-secret
           containers:

spark-analytics/base/streaming.yaml

@@ -18,6 +18,8 @@ spec:
         app.kubernetes.io/part-of: nowchess
     spec:
       serviceAccountName: spark-analytics
+      securityContext:
+        fsGroup: 185
       imagePullSecrets:
         - name: ghcr-pull-secret
       containers: