feat(example): add optional gVisor, nodeSelector, NetworkPolicy and provider keys (#21)

Add opt-in hardening to the agents-as-a-service example:
- commented runtimeClassName/nodeSelector fields for sandboxes and Deployments
- optional sandbox NetworkPolicy plus exposure-variant policies
- optional dsh-provider-keys-extra Secret for extra provider keys
- docs/optional-hardening.md with verification, caveats and rollback

The base walkthrough stays portable; no gateway code, routes or auth changed.

Co-authored-by: SREDevOpsAgents <agents@sredevops.org>

examples/dsh-agents-as-a-service/manifests/50-gateway.yaml

@@ -84,6 +84,15 @@ spec:
         app: dsh-gateway
     spec:
       serviceAccountName: dsh-gateway
+      # OPTIONAL: run the gateway under gVisor. Requires a RuntimeClass named
+      # "gvisor" and nodes that can run it. See docs/optional-hardening.md.
+      # runtimeClassName: gvisor
+      #
+      # OPTIONAL: pin the gateway to a dedicated node pool. Replace the
+      # placeholder with a label your nodes carry; add a toleration for a
+      # tainted pool. Keep active cluster-specific scheduling in a local patch.
+      # nodeSelector:
+      #   dsh.example.com/node-pool: dsh
       securityContext:
         runAsNonRoot: true
         runAsUser: 10000 # matches USER in gateway/Dockerfile