backups(kafka-metadata): the demo CLI Pod runs without a restricted securityContext #4636

The kafka-metadata backup walkthrough starts its long-lived CLI Pod with a bare kubectl run (kafka_cli_pod in examples/backups/kafka-metadata/00-helpers.sh), so the Pod gets no securityContext: no runAsNonRoot, no dropped capabilities, no seccomp profile. The kafka topic-data walkthrough runs its CLI Pods with the restricted securityContext (--overrides in examples/backups/kafka/00-helpers.sh), so the two demos disagree, and in a namespace enforcing the restricted Pod Security level this Pod would be rejected. Fix shape: create the Pod with the same restricted securityContext the kafka walkthrough uses, and add a bats case that fails if the Pod spec lacks it.