Add DeepSeek Harness Web agents-as-a-service platform pattern (#2)

Port the upstream hermes-agents-as-a-service example to DSH Web:
numbered manifests (00-prereqs .. 50-gateway), a Python gateway
(signup, per-user tokens, wake-on-connect proxy, idle suspend),
run-test-kind.sh smoke test, and docs. Fix deploy/k8s/sandbox-template.yaml
(v1beta1, correct image, volumeClaimTemplates). Add a validate workflow
(manifest server dry-run + gateway unit tests).

Co-authored-by: SREDevOpsAgents <agents@sredevops.org>

examples/dsh-agents-as-a-service/30-claim-alice.yaml

@@ -0,0 +1,19 @@
+# "User signup": one claim per user. This is the entire per-user resource —
+# the platform pattern keeps it deliberately minimal:
+#
+#   - warmPoolRef ONLY. No spec.env and no spec.volumeClaimTemplates: either
+#     would force a cold start past the warm pool (and this template's
+#     Disallowed policies reject them outright — see 40-claim-rejected.yaml).
+#   - additionalPodMetadata is the one warm-compatible per-claim
+#     customization. Label keys must use the sandbox.users.io domain.
+apiVersion: extensions.agents.x-k8s.io/v1beta1
+kind: SandboxClaim
+metadata:
+  name: dsh-alice
+  namespace: dsh-demo
+spec:
+  warmPoolRef:
+    name: dsh-pool
+  additionalPodMetadata:
+    labels:
+      sandbox.users.io/dsh-user: alice