With readOnlyRootFilesystem the s6-overlay init cannot rewrite /etc/passwd, so the containers silently kept the image's built-in uid/gid 911 instead of the configured PUID/PGID (verified at runtime) - breaking ownership on the shared media volumes. Drop the now-unneeded /run and /tmp emptyDirs; deviation documented in values.yaml.