fix(nvca): run generated worker init containers as non-root

[sbaum1994]

Planned implementation PR

Set a matching non-root runtime identity for generated function and task worker init containers. Preserve explicit pod group settings and make shared volumes writable without changing the application container UID. Cover container and Helm workloads, including the NVCA vendored translation library.

Parent: #2071

Done when

• Generated worker init containers use the image UID/GID and runAsNonRoot.
• Shared volume access works for worker init, ESS configuration, and transport trust paths.
• Function and task translator tests pass through the NVCA consumer path.