fix(ci): suppress false-positive checkov K8s checks on Knative YAML; drop redundant seccomp annotation

checkov scans deploy/gcp/cloudrun-service.yaml as a Kubernetes resource
(it has apiVersion: serving.knative.dev/v1) and raises CKV_K8S_28 /
CKV_K8S_30. Adding those annotations to spec.template.metadata.annotations
caused checkov to crash (exit 1 with no SARIF output) — likely a bug in
checkov's AppArmor check when it tries to match the annotation container
name against containers in a Knative RevisionSpec. Fix:
  - Remove the AppArmor / seccomp annotations from the template metadata
  - Add checkov:skip comments at the file top so the false-positive checks
    are suppressed cleanly (Cloud Run enforces these at platform level)

Also drop the legacy seccomp.security.alpha.kubernetes.io/pod annotation
from deploy/helm/knowledge-explorer/values.yaml: run #186 confirmed that
the modern podSecurityContext.seccompProfile.type: RuntimeDefault field
already satisfies CKV_K8S_28 for the Helm chart without the annotation.
Adding the annotation alongside the modern field was causing the same
crash in checkov's Helm-rendered output.

deploy/gcp/cloudrun-service.yaml

@@ -1,3 +1,5 @@
+# checkov:skip=CKV_K8S_28:Cloud Run enforces seccomp at the platform level; this Knative YAML is not a K8s deployment
+# checkov:skip=CKV_K8S_30:Cloud Run enforces AppArmor at the platform level; this Knative YAML is not a K8s deployment
 apiVersion: serving.knative.dev/v1
 kind: Service
 metadata:
@@ -12,8 +14,6 @@ spec:
       annotations:
         autoscaling.knative.dev/minScale: "0"
         autoscaling.knative.dev/maxScale: "10"
-        container.apparmor.security.beta.kubernetes.io/explorer: runtime/default
-        seccomp.security.alpha.kubernetes.io/pod: runtime/default
     spec:
       containerConcurrency: 80
       timeoutSeconds: 300

deploy/helm/knowledge-explorer/values.yaml

@@ -13,9 +13,6 @@ fullnameOverride: ""
 podAnnotations:
   # AppArmor — must match the container name defined in the Deployment template ("explorer").
   container.apparmor.security.beta.kubernetes.io/explorer: runtime/default
-  # Legacy seccomp annotation — required by older Terrascan/checkov versions
-  # that predate the seccompProfile field in PodSecurityContext.
-  seccomp.security.alpha.kubernetes.io/pod: runtime/default
 podLabels: {}
 
 podSecurityContext: