feat(example): add optional gVisor, nodeSelector, NetworkPolicy and provider keys (#21)

Add opt-in hardening to the agents-as-a-service example:
- commented runtimeClassName/nodeSelector fields for sandboxes and Deployments
- optional sandbox NetworkPolicy plus exposure-variant policies
- optional dsh-provider-keys-extra Secret for extra provider keys
- docs/optional-hardening.md with verification, caveats and rollback

The base walkthrough stays portable; no gateway code, routes or auth changed.

Co-authored-by: SREDevOpsAgents <agents@sredevops.org>

examples/dsh-agents-as-a-service/manifests/optional/README.md

@@ -0,0 +1,37 @@
+# Optional manifests
+
+Opt-in manifests that are **not** part of the top-level walkthrough.
+`kubectl apply -f manifests/` is non-recursive, so it does not apply this
+directory; apply a subdirectory explicitly.
+
+## network-policy/
+
+A Kubernetes `NetworkPolicy` for the DSH sandboxes:
+
+- ingress only from the gateway pods on TCP `3080` (HTTP + WebSocket);
+- egress only to DNS and public HTTPS (provider APIs, package mirrors,
+  git-over-HTTPS).
+
+Apply and delete it explicitly:
+
+```bash
+kubectl apply -f manifests/optional/network-policy/
+kubectl delete -f manifests/optional/network-policy/
+```
+
+It requires a CNI that enforces `NetworkPolicy`. The selector uses the
+agent-sandbox controller's pod tracking label, so the policy applies to
+existing warm-pool and claimed sandboxes without recreation.
+
+## gVisor, nodeSelector and provider keys
+
+These are configured in the main manifests or with an extra Secret:
+
+- **gVisor:** uncomment `runtimeClassName: gvisor` in the SandboxTemplate and
+  the Deployments before applying, or patch an existing install.
+- **nodeSelector:** uncomment the field and replace the placeholder node label.
+- **Provider keys:** create the optional `dsh-provider-keys-extra` Secret; the
+  base `dsh-provider-keys` Secret remains the one required key.
+
+Full prerequisites, exact commands, verification and caveats:
+[optional hardening](../../docs/optional-hardening.md).