Add DeepSeek Harness Web agents-as-a-service platform pattern (#2)

Port the upstream hermes-agents-as-a-service example to DSH Web:
numbered manifests (00-prereqs .. 50-gateway), a Python gateway
(signup, per-user tokens, wake-on-connect proxy, idle suspend),
run-test-kind.sh smoke test, and docs. Fix deploy/k8s/sandbox-template.yaml
(v1beta1, correct image, volumeClaimTemplates). Add a validate workflow
(manifest server dry-run + gateway unit tests).

Co-authored-by: SREDevOpsAgents <agents@sredevops.org>

examples/dsh-agents-as-a-service/40-claim-rejected.yaml

@@ -0,0 +1,18 @@
+# NEGATIVE demo: this claim carries spec.env, which the template's
+# envVarsInjectionPolicy: Disallowed rejects. The claim never binds a
+# sandbox — inspect it to see the rejection (step 6 of the README).
+#
+# Why a platform wants rejection over acceptance: env injection forces a
+# cold start that bypasses the warm pool, silently turning a ~2s signup into
+# a cold provision. Disallowed turns that mistake into a loud error.
+apiVersion: extensions.agents.x-k8s.io/v1beta1
+kind: SandboxClaim
+metadata:
+  name: dsh-mallory
+  namespace: dsh-demo
+spec:
+  warmPoolRef:
+    name: dsh-pool
+  env:
+    - name: SNEAKY_OVERRIDE
+      value: "should-not-work"