feat(example): add optional gVisor, nodeSelector, NetworkPolicy and provider keys (#21)

Add opt-in hardening to the agents-as-a-service example:
- commented runtimeClassName/nodeSelector fields for sandboxes and Deployments
- optional sandbox NetworkPolicy plus exposure-variant policies
- optional dsh-provider-keys-extra Secret for extra provider keys
- docs/optional-hardening.md with verification, caveats and rollback

The base walkthrough stays portable; no gateway code, routes or auth changed.

Co-authored-by: SREDevOpsAgents <agents@sredevops.org>

examples/dsh-agents-as-a-service/manifests/00-prereqs.yaml

@@ -1,14 +1,31 @@
-# DSH "Agents as a Service" — prerequisites: namespace + shared provider key.
+# DSH "Agents as a Service" — prerequisites: namespace + shared provider keys.
 #
 # The dsh-provider-keys Secret is deliberately NOT committed with a usable
 # value. DEEPSEEK_API_KEY reaches every tenant sandbox (injected via envFrom
 # on the SandboxTemplate, stamped before any user exists — a warm-pool
 # constraint), so a real key committed here would be shared by every install
 # of this example. Generate a fresh value per install (README step 1;
-# scripts/e2e-kind.sh uses a throwaway):
+# scripts/e2e-kind.sh uses a throwaway). Use an upsert: this manifest already
+# creates the empty Secret, so a plain `kubectl create` would fail:
 #
 #   kubectl -n dsh-demo create secret generic dsh-provider-keys \
-#     --from-literal=DEEPSEEK_API_KEY="sk-..."
+#     --from-literal=DEEPSEEK_API_KEY="sk-..." \
+#     --dry-run=client -o yaml | kubectl apply -f -
+#
+# Optional: additional providers (OpenRouter, Gemini, NVIDIA, OpenAI, ...) go
+# in a second, optional Secret. The SandboxTemplate references it with
+# `optional: true`, so sandboxes start even when it does not exist, and every
+# key in it becomes an environment variable. Create it BEFORE the warm pool,
+# because pod env is stamped at pod creation:
+#
+#   kubectl -n dsh-demo create secret generic dsh-provider-keys-extra \
+#     --from-literal=OPENROUTER_API_KEY="sk-or-..." \
+#     --from-literal=GEMINI_API_KEY="..." \
+#     --from-literal=NVIDIA_API_KEY="nvapi-..." \
+#     --dry-run=client -o yaml | kubectl apply -f -
+#
+# Supported env names, precedence, shared-key caveats and the pod-refresh
+# procedure are in docs/optional-hardening.md.
 #
 # All the infrastructure in this example works without a real key; only
 # actual model calls need one.