WIP: deploy flyte-demo (k3s) as a Union app

[pingsutw]

Summary

• Custom Dockerfile.flyte_binary to make ghcr.io/flyteorg/flyte-demo:nightly usable as an app base — k3s rootfs has no /usr/bin, static busybox, and only a partial glibc bundled for Postgres. Installs python-build-standalone, stubs libutil/libnsl/libresolv (merged into libc in glibc 2.34+), sets SSL_CERT_FILE/SSL_CERT_DIR so pyqwest can load CA certs.
• flyte_binary_app.py wires the image via Image.from_dockerfile(...), sets command=["/bin/k3d-entrypoint.sh", ...], and attaches a PodTemplate requesting privileged=true + SYS_ADMIN/NET_ADMIN.

Status — WIP

• Image builds and runs locally; flyte imports cleanly.
• App deploys to Union; the pod reaches the cluster but crashes on startup because k3s needs privileges the pod doesn't have.
• The PodTemplate securityContext is present in the Union app spec but is silently stripped before reaching the Knative Configuration — Knative generation never advances after the privileged deploy. So the privileged request is a no-op on this tenant.

Test plan

• Decide whether to pursue privileged app pods on Union (needs platform support) or redesign without k3s-in-a-pod.
• If privileged path is viable, add the volumeMounts k3s needs (/sys/fs/cgroup, /lib/modules, /var/lib/rancher).
• File a separate issue for the silent-drop of securityContext in the app control plane.