Enforce the baseline Pod Security Standard on a namespace (CKS)

CKS Lesson 4: a Deployment mounts /var/log/pods through hostPath and can read every pod's logs on the node. Preview with kubectl label --dry-run=server, enforce the baseline Pod Security Standard with one namespace label, delete the pod, and save the ReplicaSet's FailedCreate event that explains why it is not recreated. Real terminal output throughout.