02c50eb6f3
kubelet creates missing subPath mountpoint parents as root, so mounting the PVC repository cache under ~/.cache left the directory root-owned and broke both bazel's default output root and zig's wrapper cache compile (AccessDenied). The mount now lives at /opt/bazel-repo-cache.