fix(infra): pin minio/mc tags + add postgres securityContext + harden bootstrap script

Address ai-review feedback on PR #17:
- Pin quay.io/minio/minio and mc to specific RELEASE tags (Renovate
  will bump). 'latest' is unpredictable in GitOps.
- Bootstrap script: set -e -> set -euo pipefail.
- Postgres container: runAsNonRoot, uid/gid 999, drop ALL caps,
  no privilege escalation. Matches PSS restricted profile.

infra/overlays/upc-dev/forte-drop-postgresql/resources/postgresql.yaml

@@ -43,6 +43,13 @@ spec:
       containers:
       - name: postgresql
         image: postgres:16-alpine
+        securityContext:
+          runAsNonRoot: true
+          runAsUser: 999
+          runAsGroup: 999
+          allowPrivilegeEscalation: false
+          capabilities:
+            drop: [ALL]
         ports:
         - name: tcp-postgresql
           containerPort: 5432