fix(spark): add fsGroup 185 so spark user can write to PVCs

local-path PVCs are created root-owned. The apache/spark image runs as
spark (UID 185). fsGroup: 185 makes K8s chown the mounted volume to that
group on attach, fixing the mkdir IOException on /spark-checkpoint.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

spark-analytics/base/streaming.yaml

@@ -18,6 +18,8 @@ spec:
         app.kubernetes.io/part-of: nowchess
     spec:
       serviceAccountName: spark-analytics
+      securityContext:
+        fsGroup: 185
       imagePullSecrets:
         - name: ghcr-pull-secret
       containers: