docs: align readmes, docs and agent guidance with current behavior (#37)

Remove obsolete layout/migration prose and legacy gateway-alias references, reconcile the required-check policy, fix version-label/RBAC/workspace/channel drift, and de-duplicate the example and gateway docs.

Rename the minimal manifest to 10-sandboxtemplate.yaml and mount the dsh-home PVC's workspace subPath at /workspace so the documented persistence is real. Enforce numbered top-level manifests in check-examples.sh.

Verified with make check, yamllint, shellcheck, a Markdown link/anchor scan, and git diff --check.

Co-authored-by: SREDevOpsAgents <agents@sredevops.org>

examples/dsh-agents-as-a-service/manifests/10-sandboxtemplate.yaml

@@ -69,7 +69,7 @@ spec:
         # OnRootMismatch skips that walk once the volume root already carries
         # the fsGroup ownership/mode applied on the first mount.
         # Keep in sync with the minimal variant:
-        # examples/minimal-single-tenant/manifests/sandbox-template.yaml.
+        # examples/minimal-single-tenant/manifests/10-sandboxtemplate.yaml.
         fsGroupChangePolicy: OnRootMismatch
       containers:
         - name: dsh-web
@@ -103,7 +103,7 @@ spec:
             # sessions, config and credentials are unaffected. Existing
             # sandboxes stamp pod env at creation and keep the old HOME until
             # recreated. Keep in sync with the minimal variant:
-            # examples/minimal-single-tenant/manifests/sandbox-template.yaml.
+            # examples/minimal-single-tenant/manifests/10-sandboxtemplate.yaml.
             - name: HOME
               value: /workspace
             # Empty => DSH derives links from the request Host, which the