feat(repo)!: repo reorganization (#16)

* feat(repo)!: restructure around the dsh-harness image and one example per implementation

- the root Dockerfile is the primary artifact; versions.env is the single source of truth
- merge gateway-api/dsh-demo into examples/dsh-agents-as-a-service (manifests/, exposure variants)
- move the single-tenant template into examples/minimal-single-tenant
- publish the gateway as a nested package under the repository image
- mirror the DSH ref for release identities (first release dsh-v0.2.1-rc.2-r2)
- CI: lint/python/manifests/gateway-image, reusable multi-arch build, tag-driven release, weekly e2e
- docs: README, docs/{main-image,examples,gitflow,versioning}, example READMEs, AGENTS.md, governance
- SSO is opt-in again; gateway pull policy and cookie defaults match the documented demo

BREAKING CHANGE: example manifest paths, the gateway image name, and the removal
of deploy/ and gateway-api/ affect existing deployments; see the migration table
in README.md.

* docs(changelog): generate initial changelog from history

* fix(scripts): make set-version update Dockerfile and sample revision pins

* build(hadolint): document intentional lint exceptions for the main image

---------

Co-authored-by: SREDevOpsAgents <agents@sredevops.org>

.github/workflows/build-gateway.yaml

@@ -0,0 +1,69 @@
+# Development channel for the example gateway image: a merge that touches the
+# gateway publishes ghcr.io/<owner>/<repo>/dsh-agents-as-a-service/gateway:main.
+name: Build gateway image
+
+on:
+  workflow_dispatch:
+  push:
+    branches: [main]
+    paths:
+      - examples/dsh-agents-as-a-service/gateway/**
+      - versions.env
+      - .github/workflows/build-gateway.yaml
+      - .github/workflows/_build-image.yaml
+
+permissions:
+  contents: read
+  packages: write
+  id-token: write
+  attestations: write
+
+concurrency:
+  group: build-gateway-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  meta:
+    name: Read versions
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    outputs:
+      identity: ${{ steps.meta.outputs.identity }}
+      gateway_image: ${{ steps.meta.outputs.gateway_image }}
+    steps:
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - name: Read versions.env
+        id: meta
+        shell: bash
+        run: |
+          set -euo pipefail
+          while IFS= read -r line; do
+            case "$line" in ''|'#'*) continue ;; esac
+            echo "$line" >> "$GITHUB_ENV"
+          done < versions.env
+          identity="$DSH_VERSION"
+          [ -z "$RELEASE_REVISION" ] || identity="$DSH_VERSION-$RELEASE_REVISION"
+          {
+            echo "identity=$identity"
+            echo "gateway_image=$GATEWAY_IMAGE"
+          } >> "$GITHUB_OUTPUT"
+
+  build:
+    name: Build and push gateway image
+    needs: meta
+    uses: ./.github/workflows/_build-image.yaml
+    permissions:
+      contents: read
+      packages: write
+      id-token: write
+      attestations: write
+    with:
+      image: ${{ needs.meta.outputs.gateway_image }}
+      version: ${{ needs.meta.outputs.identity }}
+      context: examples/dsh-agents-as-a-service/gateway
+      dockerfile: Dockerfile
+      tags: |
+        ${{ needs.meta.outputs.gateway_image }}:main