fix(acceptance): 安全暂存脱敏快照

ConfigMap 投影文件是符号链接，而快照导入器必须拒绝链接输入。新增 initContainer 将只读投影复制为 emptyDir 中的 0600 普通文件，保留防链接安全门禁并让本地导入可执行。\n\n验证：bash -n；ShellCheck；本地 CNPG 双实例实际快照导入通过。

scripts/acceptance/local-cluster.sh

@@ -293,6 +293,22 @@ spec:
   template:
     spec:
       restartPolicy: Never
+      securityContext:
+        fsGroup: 10001
+        fsGroupChangePolicy: OnRootMismatch
+      initContainers:
+        - name: stage-snapshot
+          image: $api_image
+          command:
+            - /bin/sh
+            - -ec
+            - umask 077; cp /snapshot-source/snapshot.json /snapshot/snapshot.json
+          volumeMounts:
+            - name: snapshot-source
+              mountPath: /snapshot-source
+              readOnly: true
+            - name: snapshot
+              mountPath: /snapshot
       containers:
         - name: import
           image: $api_image
@@ -311,9 +327,11 @@ spec:
               mountPath: /snapshot
               readOnly: true
       volumes:
-        - name: snapshot
+        - name: snapshot-source
           configMap:
             name: easyai-acceptance-snapshot
+        - name: snapshot
+          emptyDir: {}
 EOF
   kubectl --context "$context" -n "$namespace" wait \
     --for=condition=complete job/easyai-local-snapshot-import --timeout=5m >/dev/null