feat(apps): fuse/parameter serde fixes for app pods + userspace volume-serve example

[kumare3]

Summary

Makes Volumes usable from Flyte apps. Three SDK fixes found by deploying a real app against demo.hosted.unionai.cloud, plus a new example that serves a sealed ROVolume from a scale-from-zero app with zero privileges.

SDK fixes (src/flyte)

1. app_serde: wrong primary container name for FUSE apps. The enable_fuse_mount pod augmentation built the template with primary container "primary"; the apps backend requires "app" (enforced in _get_k8s_pod). Deploys failed with Primary container name must be 'app'.

2. app_serde: pod-templated apps never materialized RunOutput parameters. get_proto_container received parameter_overrides, but _get_k8s_pod/_serialized_pod_spec did not — so the raw RunOutput JSON spec was baked into the fserve --parameters blob and reached on_startup un-materialized (ValidationError: Field required when the app tried to parse it). Threaded parameter_overrides through the pod path.

3. _pod: new privileged_only= mode for pod_template_with_fuse_mount. Knative's admission webhook rejects hostPath volumes (unsupported before Serving 1.17, feature-gated after) and gates capabilities.add; privileged alone implies device access + all caps, so app pods now emit only that. Caveat discovered en route: Knative silently drops privileged on every version, so kernel FUSE mounts still don't work in apps — which motivates the example below.

New example: examples/volumes/volume_browser_app.py

• repo-snapshot.snapshot_repo downloads the flyte-sdk GitHub tarball into a fresh Volume (FUSE-mounted task) and seals it; returns (ROVolume, json_spec) so the typed volume keeps UI lineage while the app picks up the JSON via a RunOutput string parameter (getter=(1,)).
• serve_volume_webdav() — prototype for a future ROVolume.serve(): the same juicefs engine mount() uses (index download + metadata materialization via plugin internals), exposed over localhost WebDAV (juicefs webdav --read-only --no-bgjob) instead of through /dev/fuse. No privileges, no PodTemplate, runs on stock Knative — only the kernel mount(2) step is skipped.
• FastAPI file browser over a stdlib WebDAV client (PROPFIND Depth:1 + GET; file-vs-dir decided from the self entry's resourcetype since PROPFIND on a file still 207s).
• Scaling(replicas=(0, 1), scaledown_after=300) — scale-from-zero; each cold start is one index download + a subprocess spawn.

Test plan

• tests/flyte/app/ (121 tests) pass
• WebDAV client + serve flow validated locally against a file://-backed juicefs volume (dir listing, file read, 404, read-only rejects writes)
• End-to-end on demo.hosted.unionai.cloud: snapshot run succeeded; app deployed unprivileged on Knative 1.16 (no feature flags); /browse/, deep listings, and file reads all serve from the sealed volume

🤖 Generated with Claude Code