chore: tidy initContainers

- make initcontainers easier to read/follow

apps/base/puppet/deployment_puppetserver-compiler.yaml

@@ -128,25 +128,26 @@ spec:
         - mountPath: /configmaps/autosign.conf
           name: compiler-autosign-conf
           subPath: autosign.conf
-      - args:
-        - mkdir -p /etc/puppetlabs/puppet/eyaml/keys;
-          mkdir -p /etc/puppetlabs/code/environments;
-          mkdir -p /etc/puppetlabs/puppet/manifests;
-          chown -R puppet:puppet /etc/puppetlabs;
-          chown puppet:puppet /etc/puppetlabs/puppet/r10k.yaml;
-          mkdir -p /opt/puppetlabs/server/data/puppetserver/dropsonde/bin/;
-          touch /opt/puppetlabs/server/data/puppetserver/dropsonde/bin/dropsonde;
-          chown puppet:puppet -R /opt/puppetlabs/server/data/puppetserver/;
+
+      - name: perms-and-dirs
+        image: ghcr.io/openvoxproject/openvoxserver:8.8.0-main
+        imagePullPolicy: IfNotPresent
         command:
         - sh
         - -c
+        args:
+        - |
+          mkdir -p /etc/puppetlabs/puppet/eyaml/keys
+          mkdir -p /etc/puppetlabs/code/environments
+          mkdir -p /etc/puppetlabs/puppet/manifests
+          chown -R puppet:puppet /etc/puppetlabs
+          chown puppet:puppet /etc/puppetlabs/puppet/r10k.yaml
+          mkdir -p /opt/puppetlabs/server/data/puppetserver/dropsonde/bin/
+          touch /opt/puppetlabs/server/data/puppetserver/dropsonde/bin/dropsonde
+          chown puppet:puppet -R /opt/puppetlabs/server/data/puppetserver/
         env:
         - name: PUPPETSERVER_JAVA_ARGS
           value: -Xms1024m -Xmx3072m -Dcom.sun.management.jmxremote.port=31000 -Dcom.sun.management.jmxremote.authenticate=false -Dcom.sun.management.jmxremote.ssl=false
-        envFrom: null
-        image: ghcr.io/openvoxproject/openvoxserver:8.8.0-main
-        imagePullPolicy: IfNotPresent
-        name: perms-and-dirs
         resources:
           limits:
             cpu: 300m
@@ -155,6 +156,8 @@ spec:
             cpu: 200m
             memory: 128Mi
         securityContext:
+          runAsUser: 0
+          runAsNonRoot: false
           capabilities:
             add:
             - CAP_CHOWN
@@ -171,13 +174,12 @@ spec:
             - FOWNER
             drop:
             - all
-          runAsNonRoot: false
-          runAsUser: 0
         volumeMounts:
         - mountPath: /etc/puppetlabs/code/
           name: puppet-code-volume
         - mountPath: /etc/puppetlabs/puppet/
           name: puppet-puppet-volume
+
       - name: setup-shared-bins
         image: git.unkin.net/unkin/almalinux9-base:20260308
         command: