Merge the independently reviewed non-root image and hardened k3s deployment contract.
Integrate the verified v0.1.1 release history before v0.1.2 preparation.