A PodSecurity restricted namespace blocks the init container's chown workaround, and the volume owner never becomes writable

The app and volume are healthy in isolation, but the compatibility shim is no longer allowed to run.