fix(runtimes): add restricted PSS security contexts

[danish9039]

What this PR does / why we need it:

This PR makes the Torch distributed Trainer runtime manifests and matching Helm templates restricted-PSS compatible.

It adds pod and container security contexts for the Torch distributed runtime and the data-cache variant, and updates Helm unit tests to cover those fields.

The runtime containers preserve each image's configured working directory so custom images retain their existing command and relative-path behavior.

The CPU end-to-end tests also require kubeflow/sdk#604, which writes SDK-generated files to a writable location without overriding the image working directory.

Validation:

• make helm-unittest passed: 18 suites / 109 tests
• kustomize build manifests/base/runtimes
• kustomize build manifests/base/runtimes/data-cache
• helm template from a temporary chart copy after dependency build
• git diff --check

Which issue(s) this PR fixes (optional, in Fixes #<issue number>, #<issue number>, ... format, will close the issue(s) when PR gets merged):
Related to kubeflow/community-distribution#3487

Checklist:

• Docs included if any changes are user facing

[github-actions]

🎉 Welcome to the Kubeflow Trainer! 🎉

Thanks for opening your first PR! We're happy to have you as part of our community 🚀

Here's what happens next:

• If you haven't already, please check out our Contributing Guide for repo-specific guidelines and the Kubeflow Contributor Guide for general community standards.
• Our team will review your PR soon! cc @kubeflow/kubeflow-trainer-team

Join the community:

• Slack: Join our #kubeflow-trainer Slack channel.
• Meetings: Attend the Kubeflow AutoML and Training Working Group bi-weekly meetings.

Feel free to ask questions in the comments if you need any help or clarification!
Thanks again for contributing to Kubeflow! 🙏

[google-oss-prow]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign jeffwan for approval. For more information see the Kubernetes Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[Copilot]

Pull request overview

Adds restricted-PSS settings to Torch distributed runtimes and their Helm equivalents.

Changes:

• Adds pod and container security contexts.
• Configures /tmp as the training-node working directory.
• Adds Helm rendering assertions.

Reviewed changes

Copilot reviewed 6 out of 6 changed files in this pull request and generated 6 comments.

Show a summary per file

File	Description
manifests/base/runtimes/torch_distributed.yaml	Adds Torch runtime security settings.
manifests/base/runtimes/data-cache/torch_distributed_with_cache.yaml	Adds security settings to cached training jobs.
charts/kubeflow-trainer/templates/runtimes/torch-distributed.yaml	Mirrors settings in the Helm template.
charts/kubeflow-trainer/templates/runtimes/data-cache/torch-distributed-with-cache.yaml	Mirrors cached-runtime settings in Helm.
charts/kubeflow-trainer/tests/runtimes/torch_distributed_test.yaml	Tests rendered Torch security settings.
charts/kubeflow-trainer/tests/runtimes/torch_distributed_with_cache_test.yaml	Tests rendered cached-runtime security settings.

[Copilot]

Pull request overview

Copilot reviewed 9 out of 9 changed files in this pull request and generated 1 comment.

[danish9039]

The CPU end-to-end failure is addressed by kubeflow/sdk#604, which keeps generated files writable without overriding custom image working directories.