fix(chart): set Praxis AI runtime identity

[nerdalert]

Summary

The official Praxis AI 0.3.0 image declares the named user praxis:praxis (UID 100, GID 101). Kubernetes cannot verify that a named image user is non-root before starting the container, so the Praxis gateway chart's existing runAsNonRoot: true default can reject the otherwise valid image.

This change:

• defaults the gateway pod to numeric UID 100 and GID 101, matching the official Praxis AI 0.3.0 image;
• keeps the chart-owned restricted security controls unchanged;
• documents how custom images can override the numeric identity;
• documents and tests the OpenShift path, where setting both values to null lets the restricted SCC assign namespace-specific IDs;
• adds Helm regression checks for both the default identity and the OpenShift override;
• corrects the release guide to use the provider qualification's supported --quick mode instead of the rejected --full flag.

This is intended for the next Grid release. It does not modify the already-published v0.1.4 tag, Forge topology behavior, Grid routing, or Praxis AI.

Validation

• Official Praxis AI 0.3.0 image smoke-tested in Kind under restricted Pod Security
• Effective runtime identity verified as UID 100 / GID 101
• Configuration readability and writable /tmp verified
• runAsNonRoot, RuntimeDefault seccomp, disabled privilege escalation, and dropped capabilities verified
• OpenShift-style null overrides verified to omit fixed UID/GID while preserving restricted controls
• scripts/verify-helm-chart.sh: 168 passed, 0 failed
• git diff --check: passed

Generated Forge resolution files were excluded from the commit.