fix: Chown the chart's volume once rather than on every start

Setting `fsGroup` without a change policy leaves Kubernetes on its default of
`Always`, which walks the whole volume and chowns every file each time the pod
starts. On an instance with a few thousand attachments that turns every
restart into a wait, and a slow enough one fails the readiness probe.

`OnRootMismatch` checks the top directory and stops there when it already
matches, so an existing volume pays the walk once.

charts/planka/values.yaml

@@ -53,6 +53,10 @@ podAnnotations: {}
 
 podSecurityContext:
   fsGroup: 1000
+  # Without this Kubernetes chowns every file on the volume on each pod start,
+  # which on an instance with a lot of attachments delays every restart for as
+  # long as the walk takes. OnRootMismatch pays that once.
+  fsGroupChangePolicy: OnRootMismatch
 
 # Annotations to add to the deployment
 deploymentAnnotations: {}