Fix idle sweeper suspending claims the gateway does not own (#4)

The sweeper listed every SandboxClaim in NAMESPACE and treated each
dsh-<user> name as one of its own users. A claim applied by hand from
the resource-layer manifests (e.g. 30-claim-alice.yaml) therefore looked
exactly like a gateway user: the idle clock started on first sighting
and the pod was suspended after IDLE_TIMEOUT. That deletes the pod the
README's step 3 logs/port-forward targets, so the walkthrough broke as
soon as the gateway was deployed next to it.

Mark claims created by create_claim() with
aaas.example.com/managed-by=dsh-gateway and skip everything else in
sweep_once() before any idle bookkeeping happens. Document the
ownership boundary in the example docs, the manifest and ADR-5, add
unit coverage for the marker and the skipped sweep, and assert in
run-test-kind.sh that alice's hand-applied claim stays Running while
bob is correctly idle-suspended.

Co-authored-by: SREDevOpsAgents <agents@sredevops.org>

examples/dsh-agents-as-a-service/run-test-kind.sh

@@ -228,6 +228,15 @@ PY
   [ "$STATE" = "Suspended" ] || fail "bob was not idle-suspended (state=$STATE)"
   pass "idle sweeper suspended bob"
 
+  # Regression: alice's claim was applied by hand in step 2, so it has no
+  # aaas.example.com/managed-by annotation. The sweeper must leave it alone -
+  # even though the same idle window just suspended bob. If it does not, README
+  # step 3 (logs/port-forward against alice's pod) breaks.
+  ALICE_MODE=$(kubectl -n "$NS" get sandbox "$SB" -o jsonpath='{.spec.operatingMode}')
+  [ "$ALICE_MODE" = "Running" ] \
+    || fail "sweeper suspended a claim it does not own (alice: $ALICE_MODE)"
+  pass "idle sweeper left the hand-applied alice claim Running"
+
   T0=$(date +%s)
   curl -sf -m 150 -b "$JAR" "http://$GW/u/bob/" >/dev/null \
     || fail "wake-on-connect request failed"