Preserve production namespace security labels

[BraydenLangley]

Summary

• declare the live papertrade-prod Pod Security labels in the source namespace manifest
• satisfy the cluster namespace admission contract during GitHub Actions deployments
• preserve baseline enforcement with restricted audit/warn checks at Kubernetes v1.34

Context

Production run 33667585656 built the requested UI image but its deploy step was rejected because the source namespace manifest omitted the required labels. The live namespace already has these exact labels.

Validation

• server-side dry-run: namespace/papertrade-prod configured (server dry run)
• git diff --check