Socket-based syncs blocked by AKS ContainerNoPrivilegeEscalation Policy

### Helm Chart Version

2.0.17

### What step the error happened?

During the Sync

### Relevant information

Following an update of the Databricks destination to 4.0.1, connections from sources supporting `SOCKET` transport began failing with this error during the sync step:

```
ERROR Stage Pipeline Exception: io.airbyte.workload.launcher.pipeline.stages.model.StageError: io.airbyte.workers.exception.KubeClientException: Failed to create pod replication-job-15469-attempt-0.
message: io.airbyte.workers.exception.KubeClientException: Failed to create pod replication-job-15469-attempt-0.
stackTrace: [Ljava.lang.StackTraceElement;@5e61742d
```

Sources that only supported `STDOI` continued to work.

### Debugging

The failure was traced to an AKS gatekeeper denial for a ContainerNoPrivilegeEscalation policy violation. I was able to repro this failure using a security context based on [the `securityContext` created](https://github.com/airbytehq/airbyte-platform/blob/2d96861799e85bec7ddc9a60cccd93866bd549e2/airbyte-workload-launcher/src/main/kotlin/pods/factories/ReplicationPodFactory.kt#L125-L126) when the `SOCKET` transport is selected:

```
securityContext:
runAsUser: 1000
runAsGroup: 1000
fsGroup: 1000
fsGroupChangePolicy: OnRootMismatch
runAsNonRoot: true
seccompProfile:
type: RuntimeDefault
```

When tested against the AKS gatekeeper:

```
PS > kubectl create --dry-run=server -f "socket-dryrun-pod.yaml" 2>&1
Error from server (Forbidden): error when creating "socket-dryrun-pod.yaml": admission webhook "validation.gatekeeper.sh" denied the request: [azurepolicy-k8sazurev3noprivilegeescalatio-f398463faa240def6d38] Privilege escalation container is not allowed: destination
[azurepolicy-k8sazurev3noprivilegeescalatio-f398463faa240def6d38] Privilege escalation container is not allowed: init
[azurepolicy-k8sazurev3noprivilegeescalatio-f398463faa240def6d38] Privilege escalation container is not allowed: orchestrator
[azurepolicy-k8sazurev3noprivilegeescalatio-f398463faa240def6d38] Privilege escalation container is not allowed: source
```

The ContainerNoPrivilegeEscalation policy (https://github.com/Azure/azure-policy/blob/f600c952718e8d2fc1c4fe92c516100d2ad85999/built-in-policies/policyDefinitions/Kubernetes/ContainerNoPrivilegeEscalation.json#L169) is set to block `securityContext` configs that use any value other than `false` if they set a `runAsUser` value other than zero:

```
PS > kubectl get constrainttemplate k8sazurev3noprivilegeescalation -o jsonpath='{.spec.targets[0].rego}'
package k8sazurev3noprivilegeescalation

import data.lib.exclude_container_image.is_excluded

# The following scenerios will be viewed as violations. Windows containers are not supported
## allowPrivilegeEscalation=true
## runAsUser != 0 + missing allowPrivilegeEscalation=false

violation[{"msg": msg, "details": {}}] {
not input.review.object.spec.nodeSelector["kubernetes.io/os"] == "windows"
c := input_containers[_]
not input_container_excluded(c.name)
not is_excluded(c)
input_allow_privilege_escalation(c)
msg := sprintf("Privilege escalation container is not allowed: %v", [c.name])
}

input_allow_privilege_escalation(c) {
c.securityContext.allowPrivilegeEscalation == true
}
input_allow_privilege_escalation(c) {
not c.securityContext.allowPrivilegeEscalation == false
c.securityContext.runAsUser != 0
}
input_allow_privilege_escalation(c) {
not c.securityContext.allowPrivilegeEscalation == false
not c.securityContext.runAsUser
input.review.object.spec.securityContext.runAsUser != 0
}
input_containers[c] {
c := input.review.object.spec.containers[_]
}
input_containers[c] {
c := input.review.object.spec.initContainers[_]
}
input_containers[c] {
c := input.review.object.spec.ephemeralContainers[_]
}
input_container_excluded(field) {
field == input.parameters.excludedContainers[_]
}
```

### Solutions

Given an updated `securityContext` value with `allowPrivilegeEscalation: false`, the gatekeeper dry-run permitted the pod creation. This is consistent with the definition for [`WorkloadSecurityContextProvider.baseContainerSecurityContext()`](https://github.com/airbytehq/airbyte-platform/blob/v1.8.0/airbyte-workload-launcher/src/main/kotlin/context/WorkloadSecurityContextProvider.kt#L104-L114):

```
private fun baseContainerSecurityContext(
user: Long,
group: Long,
): SecurityContextBuilder =
SecurityContextBuilder()
.withRunAsUser(user)
.withRunAsGroup(group)
.withAllowPrivilegeEscalation(false)
.withReadOnlyRootFilesystem(false)
.withCapabilities(CapabilitiesBuilder().addAllToDrop(DEFAULT_CAPABILITIES).build())
}
```

The current workaround is to use an AKS cluster mutation policy to inject `allowPrivilegeEscalation: false`, but ideally Airbyte should work out of the box with the ContainerNoPrivilegeEscalation policy in effect?

The issue reported at https://github.com/airbytehq/airbyte/issues/77613 is partially related, but in that case the `securityContext` is reported as an empty `{}` which is what we're seeing for `STDIO` sources without a gatekeeper failure.

### Relevant log output

```shell
2026-08-06 14:18:02 platform INFO APPLY Stage: BUILD — (workloadId=c20f60e7-c0e9-440f-8795-73d841838c28_15469_0_sync)
2026-08-06 14:18:02 platform INFO APPLY Stage: CLAIM — (workloadId=c20f60e7-c0e9-440f-8795-73d841838c28_15469_0_sync)
2026-08-06 14:18:02 platform INFO Claimed: true for workload c20f60e7-c0e9-440f-8795-73d841838c28_15469_0_sync via API in dataplane AUTO3fbd01c3-f8e0-4107-9f4a-dd14270550a1 (3cb4b628-3345-4590-bd66-ddf751089fd8)
2026-08-06 14:18:02 platform INFO APPLY Stage: LOAD_SHED — (workloadId=c20f60e7-c0e9-440f-8795-73d841838c28_15469_0_sync)
2026-08-06 14:18:02 platform INFO APPLY Stage: CHECK_STATUS — (workloadId=c20f60e7-c0e9-440f-8795-73d841838c28_15469_0_sync)
2026-08-06 14:18:02 platform INFO No pod found running for workload c20f60e7-c0e9-440f-8795-73d841838c28_15469_0_sync
2026-08-06 14:18:02 platform INFO APPLY Stage: MUTEX — (workloadId=c20f60e7-c0e9-440f-8795-73d841838c28_15469_0_sync)
2026-08-06 14:18:02 platform INFO Mutex key: c20f60e7-c0e9-440f-8795-73d841838c28 specified for workload: c20f60e7-c0e9-440f-8795-73d841838c28_15469_0_sync. Attempting to delete existing pods...
2026-08-06 14:18:02 platform INFO Mutex key: c20f60e7-c0e9-440f-8795-73d841838c28 specified for workload: c20f60e7-c0e9-440f-8795-73d841838c28_15469_0_sync found no existing pods. Continuing...
2026-08-06 14:18:02 platform INFO APPLY Stage: ARCHITECTURE — (workloadId=c20f60e7-c0e9-440f-8795-73d841838c28_15469_0_sync)
2026-08-06 14:18:02 platform INFO APPLY Stage: LAUNCH — (workloadId=c20f60e7-c0e9-440f-8795-73d841838c28_15469_0_sync)
2026-08-06 14:18:02 platform INFO [initContainer] image: airbyte/workload-init-container:1.8.5 resources: ResourceRequirements(claims=[], limits={memory=1024Mi, cpu=1}, requests={memory=1024Mi, cpu=1}, additionalProperties={})
2026-08-06 14:18:02 platform INFO Launching replication pod: replication-job-15469-attempt-0 (selectors = {workload_type=jobs}) with containers:
2026-08-06 14:18:02 platform INFO [source] image: airbyte/source-mysql:3.51.1 resources: ResourceRequirements(claims=[], limits={memory=4Gi, cpu=1}, requests={memory=2Gi, cpu=0.5}, additionalProperties={})
2026-08-06 14:18:02 platform INFO [destination] image: airbyte/destination-databricks:4.0.1 resources: ResourceRequirements(claims=[], limits={memory=4Gi, cpu=1}, requests={memory=2Gi, cpu=0.5}, additionalProperties={})
2026-08-06 14:18:02 platform INFO [orchestrator] image: airbyte/container-orchestrator:1.8.5 resources: ResourceRequirements(claims=[], limits={memory=1024Mi, cpu=1}, requests={memory=1024Mi, cpu=1}, additionalProperties={})
2026-08-06 14:18:02 platform ERROR Stage Pipeline Exception: io.airbyte.workload.launcher.pipeline.stages.model.StageError: io.airbyte.workers.exception.KubeClientException: Failed to create pod replication-job-15469-attempt-0.
message: io.airbyte.workers.exception.KubeClientException: Failed to create pod replication-job-15469-attempt-0.
stackTrace: [Ljava.lang.StackTraceElement;@5e61742d
2026-08-06 14:18:02 platform INFO Attempting to update workload: c20f60e7-c0e9-440f-8795-73d841838c28_15469_0_sync to FAILED.
2026-08-06 14:18:02 platform INFO Pipeline aborted after error for workload: c20f60e7-c0e9-440f-8795-73d841838c28_15469_0_sync.
2026-08-06 14:18:03 platform INFO
----- START POST REPLICATION OPERATIONS -----

2026-08-06 14:18:03 platform INFO No post-replication operation(s) to perform.
2026-08-06 14:18:03 platform INFO
----- END POST REPLICATION OPERATIONS -----
```

---
**Internal Tracking:** https://github.com/airbytehq/oncall/issues/12122