Read the user: field from compose service definitions and map it to
securityContext.runAsUser on the k8s container spec. Needed for init
containers using images that run as non-root by default (e.g.
bitnami/kubectl runs as UID 1001).
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>