feat(example): add optional gVisor, nodeSelector, NetworkPolicy and provider keys (#21)

Add opt-in hardening to the agents-as-a-service example:
- commented runtimeClassName/nodeSelector fields for sandboxes and Deployments
- optional sandbox NetworkPolicy plus exposure-variant policies
- optional dsh-provider-keys-extra Secret for extra provider keys
- docs/optional-hardening.md with verification, caveats and rollback

The base walkthrough stays portable; no gateway code, routes or auth changed.

Co-authored-by: SREDevOpsAgents <agents@sredevops.org>

scripts/check-examples.sh

@@ -29,6 +29,10 @@ for dir in examples/*/; do
     err "$name: manifests/exposure/ requires a README.md describing the variants"
   fi
 
+  if [ -d "${dir}manifests/optional" ] && [ ! -f "${dir}manifests/optional/README.md" ]; then
+    err "$name: manifests/optional/ requires a README.md describing the opt-in manifests"
+  fi
+
   for component in "$dir"*/; do
     [ -d "$component" ] || continue
     case "$(basename "$component")" in