feat(repo)!: repo reorganization (#16)

* feat(repo)!: restructure around the dsh-harness image and one example per implementation

- the root Dockerfile is the primary artifact; versions.env is the single source of truth
- merge gateway-api/dsh-demo into examples/dsh-agents-as-a-service (manifests/, exposure variants)
- move the single-tenant template into examples/minimal-single-tenant
- publish the gateway as a nested package under the repository image
- mirror the DSH ref for release identities (first release dsh-v0.2.1-rc.2-r2)
- CI: lint/python/manifests/gateway-image, reusable multi-arch build, tag-driven release, weekly e2e
- docs: README, docs/{main-image,examples,gitflow,versioning}, example READMEs, AGENTS.md, governance
- SSO is opt-in again; gateway pull policy and cookie defaults match the documented demo

BREAKING CHANGE: example manifest paths, the gateway image name, and the removal
of deploy/ and gateway-api/ affect existing deployments; see the migration table
in README.md.

* docs(changelog): generate initial changelog from history

* fix(scripts): make set-version update Dockerfile and sample revision pins

* build(hadolint): document intentional lint exceptions for the main image

---------

Co-authored-by: SREDevOpsAgents <agents@sredevops.org>

scripts/check-manifests.py

@@ -0,0 +1,47 @@
+#!/usr/bin/env python3
+"""Parse every example manifest and assert the minimal Kubernetes shape."""
+from __future__ import annotations
+
+import sys
+from pathlib import Path
+
+try:
+    import yaml
+except ModuleNotFoundError:  # pragma: no cover - environment guard
+    sys.exit("check-manifests: PyYAML is required (python -m pip install pyyaml)")
+
+ROOT = Path(__file__).resolve().parent.parent
+FILES = sorted(ROOT.glob("examples/*/manifests/**/*.yaml"))
+
+if not FILES:
+    sys.exit("check-manifests: no manifests found under examples/*/manifests/")
+
+errors: list[str] = []
+documents = 0
+for path in FILES:
+    relative = path.relative_to(ROOT)
+    try:
+        loaded = list(yaml.safe_load_all(path.read_text(encoding="utf-8")))
+    except yaml.YAMLError as exc:
+        errors.append(f"{relative}: invalid YAML: {exc}")
+        continue
+    for position, document in enumerate(loaded, start=1):
+        if document is None:
+            continue
+        documents += 1
+        if not isinstance(document, dict):
+            errors.append(f"{relative} document {position}: not a mapping")
+            continue
+        missing = [key for key in ("apiVersion", "kind", "metadata") if key not in document]
+        if missing:
+            errors.append(f"{relative} document {position}: missing {', '.join(missing)}")
+            continue
+        metadata = document["metadata"]
+        if not isinstance(metadata, dict) or not metadata.get("name"):
+            errors.append(f"{relative} document {position}: metadata.name is required")
+
+if errors:
+    print("\n".join(errors), file=sys.stderr)
+    sys.exit(1)
+
+print(f"check-manifests: ok ({len(FILES)} files, {documents} documents)")