Avoid full-home chown on startup and add SSH startupProbe.

chown -R over a multi-GB PVC blocked sshd past liveness and risked restart loops after volume reattach.

deploy/020-statefulset.yaml

@@ -49,15 +49,19 @@ spec:
             limits:
               cpu: "4"
               memory: 8Gi
+          # startupProbe covers slow first boot (sshd after host-key/auth setup).
+          startupProbe:
+            tcpSocket:
+              port: ssh
+            failureThreshold: 60
+            periodSeconds: 10
           readinessProbe:
             tcpSocket:
               port: ssh
-            initialDelaySeconds: 5
             periodSeconds: 10
           livenessProbe:
             tcpSocket:
               port: ssh
-            initialDelaySeconds: 15
             periodSeconds: 20
           volumeMounts:
             - name: home

entrypoint.sh

@@ -24,9 +24,12 @@ if [ -f "${AUTH_KEYS_SRC}" ]; then
   install -m 600 -o developer -g developer "${AUTH_KEYS_SRC}" "${HOME_DIR}/.ssh/authorized_keys"
 fi
 # sshd StrictModes rejects auth if $HOME is group/world-writable.
+# Do not chown -R the whole PVC (tens of GB) — that blocks sshd past liveness and
+# caused empty-home recovery restarts to loop. Ownership is uid 1000 (developer).
 chmod 755 "${HOME_DIR}"
 chmod 700 "${HOME_DIR}/.ssh"
-chown -R developer:developer "${HOME_DIR}"
+chown developer:developer "${HOME_DIR}" "${HOME_DIR}/.ssh" "${HOME_DIR}/workspace" 2>/dev/null || true
+chown -R developer:developer "${HOME_DIR}/.ssh-host" 2>/dev/null || true
 
 # DinD sidecar listens on TCP; ensure SSH login shells see DOCKER_HOST.
 grep -q '^DOCKER_HOST=' /etc/environment 2>/dev/null \