Fix DDNS/failover Cloudflare zone name and add restricted PSS securityContext

- ZONE_NAME was "kube.huskypup.net" in both the home-ip-ddns CronJob and
  the VPS failover watcher - that's a record, not a Cloudflare zone (the
  actual zone is the parent "huskypup.net"). Caused home-ip-ddns to fail
  every run (zone lookup returned zero results, curl -f exit 22) -
  confirmed live and fixed.
- Added seccompProfile/non-root/dropped-capabilities securityContext to
  the three CronJobs added this session that were missing it (flagged by
  the cluster's "restricted" PodSecurity admission). Repointed the raft
  snapshot job's mc binary install from /usr/local/bin to /tmp so it
  still works running as non-root.

infrastructure/vault/manifests/raft-snapshot-cronjob.yaml

@@ -60,17 +60,18 @@ data:
     kubectl -n vault exec vault-0 -- rm -f "/tmp/${SNAP_NAME}"
 
     echo "==> Installing mc (MinIO client)..."
-    curl -sf https://dl.min.io/client/mc/release/linux-amd64/mc -o /usr/local/bin/mc
-    chmod +x /usr/local/bin/mc
-    mc alias set vps-minio "http://${VPS_MINIO_ENDPOINT}" \
+    curl -sf https://dl.min.io/client/mc/release/linux-amd64/mc -o /tmp/mc
+    chmod +x /tmp/mc
+    export MC_CONFIG_DIR=/tmp/.mc
+    /tmp/mc alias set vps-minio "http://${VPS_MINIO_ENDPOINT}" \
       "${MINIO_ACCESS_KEY}" "${MINIO_SECRET_KEY}" >/dev/null
 
     echo "==> Uploading ${SNAP_NAME} to vps-minio/${BUCKET}..."
-    mc cp "/tmp/${SNAP_NAME}" "vps-minio/${BUCKET}/${SNAP_NAME}"
+    /tmp/mc cp "/tmp/${SNAP_NAME}" "vps-minio/${BUCKET}/${SNAP_NAME}"
     rm -f "/tmp/${SNAP_NAME}"
 
     echo "==> Pruning snapshots older than 30 days..."
-    mc find "vps-minio/${BUCKET}" --older-than 30d --exec "mc rm {}" || true
+    /tmp/mc find "vps-minio/${BUCKET}" --older-than 30d --exec "/tmp/mc rm {}" || true
 
     echo "==> Done: ${SNAP_NAME}"
 ---
@@ -91,10 +92,19 @@ spec:
         spec:
           serviceAccountName: argocd-hook-sa  # already has kubectl exec rights in this namespace (see vault-init-job.yaml)
           restartPolicy: Never
+          securityContext:
+            runAsNonRoot: true
+            runAsUser: 65534
+            seccompProfile:
+              type: RuntimeDefault
           containers:
             - name: raft-snapshot
               image: alpine/k8s:1.32.13
               command: ["/bin/bash", "/scripts/snapshot.sh"]
+              securityContext:
+                allowPrivilegeEscalation: false
+                capabilities:
+                  drop: ["ALL"]
               env:
                 - name: MINIO_ACCESS_KEY
                   valueFrom: