feat(repo)!: repo reorganization (#16)

* feat(repo)!: restructure around the dsh-harness image and one example per implementation

- the root Dockerfile is the primary artifact; versions.env is the single source of truth
- merge gateway-api/dsh-demo into examples/dsh-agents-as-a-service (manifests/, exposure variants)
- move the single-tenant template into examples/minimal-single-tenant
- publish the gateway as a nested package under the repository image
- mirror the DSH ref for release identities (first release dsh-v0.2.1-rc.2-r2)
- CI: lint/python/manifests/gateway-image, reusable multi-arch build, tag-driven release, weekly e2e
- docs: README, docs/{main-image,examples,gitflow,versioning}, example READMEs, AGENTS.md, governance
- SSO is opt-in again; gateway pull policy and cookie defaults match the documented demo

BREAKING CHANGE: example manifest paths, the gateway image name, and the removal
of deploy/ and gateway-api/ affect existing deployments; see the migration table
in README.md.

* docs(changelog): generate initial changelog from history

* fix(scripts): make set-version update Dockerfile and sample revision pins

* build(hadolint): document intentional lint exceptions for the main image

---------

Co-authored-by: SREDevOpsAgents <agents@sredevops.org>

scripts/check-examples.sh

@@ -0,0 +1,56 @@
+#!/usr/bin/env bash
+# Enforce the example contract documented in docs/examples.md.
+# Run by "make check" locally and by the CI lint job.
+set -euo pipefail
+cd "$(dirname "$0")/.."
+
+index=examples/README.md
+fail=0
+err() { echo "check-examples: $*" >&2; fail=1; }
+
+[ -f "$index" ] || err "missing $index"
+
+for dir in examples/*/; do
+  name="$(basename "$dir")"
+  [ "$name" = "_template" ] && continue
+
+  [ -f "${dir}README.md" ] || err "$name: missing README.md"
+  [ -d "${dir}manifests" ] || err "$name: missing manifests/"
+
+  if [ -d "${dir}manifests" ]; then
+    count=$(find "${dir}manifests" -maxdepth 1 -type f -name '*.yaml' | wc -l | tr -d ' ')
+    [ "$count" -gt 0 ] || err "$name: manifests/ has no top-level *.yaml files"
+  fi
+
+  stray=$(find "$dir" -maxdepth 1 -type f -name '*.yaml' | wc -l | tr -d ' ')
+  [ "$stray" -eq 0 ] || err "$name: manifests belong under manifests/, not at the example root"
+
+  if [ -d "${dir}manifests/exposure" ] && [ ! -f "${dir}manifests/exposure/README.md" ]; then
+    err "$name: manifests/exposure/ requires a README.md describing the variants"
+  fi
+
+  for component in "$dir"*/; do
+    [ -d "$component" ] || continue
+    case "$(basename "$component")" in
+      manifests|scripts|docs) continue ;;
+    esac
+    if [ -f "${component}Dockerfile" ] && [ ! -f "${component}README.md" ]; then
+      err "$name/$(basename "$component"): component with a Dockerfile needs a README.md"
+    fi
+  done
+
+  if ! grep -Fq "examples/$name/" "$index"; then
+    err "$name: not listed in examples/README.md"
+  fi
+
+  for script in "$dir"scripts/*.sh; do
+    [ -e "$script" ] || continue
+    [ -x "$script" ] || err "$script: must be executable"
+  done
+done
+
+if [ "$fail" -ne 0 ]; then
+  echo "check-examples: FAILED" >&2
+  exit 1
+fi
+echo "check-examples: ok"