Add DeepSeek Harness Web agents-as-a-service platform pattern (#2)

Port the upstream hermes-agents-as-a-service example to DSH Web:
numbered manifests (00-prereqs .. 50-gateway), a Python gateway
(signup, per-user tokens, wake-on-connect proxy, idle suspend),
run-test-kind.sh smoke test, and docs. Fix deploy/k8s/sandbox-template.yaml
(v1beta1, correct image, volumeClaimTemplates). Add a validate workflow
(manifest server dry-run + gateway unit tests).

Co-authored-by: SREDevOpsAgents <agents@sredevops.org>

examples/dsh-agents-as-a-service/50-gateway.yaml

@@ -0,0 +1,94 @@
+# The gateway: control+data plane that turns the resources into a usable
+# service. Build the image first (see README step 8):
+#   docker build -t dsh-aaas-gateway:demo gateway/
+#   kind load docker-image dsh-aaas-gateway:demo   # (kind clusters)
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: dsh-gateway
+  namespace: dsh-demo
+---
+# Least privilege: claims are created/deleted per user; sandboxes are only
+# read and patched (operatingMode flips for suspend/resume).
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: dsh-gateway
+  namespace: dsh-demo
+rules:
+  - apiGroups: ["extensions.agents.x-k8s.io"]
+    resources: ["sandboxclaims"]
+    verbs: ["get", "list", "create", "delete"]
+  - apiGroups: ["agents.x-k8s.io"]
+    resources: ["sandboxes"]
+    verbs: ["get", "list", "patch"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: dsh-gateway
+  namespace: dsh-demo
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: dsh-gateway
+subjects:
+  - kind: ServiceAccount
+    name: dsh-gateway
+    namespace: dsh-demo
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: dsh-gateway
+  namespace: dsh-demo
+spec:
+  replicas: 1 # in-memory idle clock => single replica by design
+  selector:
+    matchLabels:
+      app: dsh-gateway
+  template:
+    metadata:
+      labels:
+        app: dsh-gateway
+    spec:
+      serviceAccountName: dsh-gateway
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 10000 # matches USER in gateway/Dockerfile
+        runAsGroup: 10000
+        seccompProfile:
+          type: RuntimeDefault
+      containers:
+        - name: gateway
+          image: dsh-aaas-gateway:demo
+          imagePullPolicy: IfNotPresent
+          securityContext:
+            allowPrivilegeEscalation: false
+            readOnlyRootFilesystem: true
+            capabilities:
+              drop: ["ALL"]
+          ports:
+            - containerPort: 8080
+          env:
+            - name: NAMESPACE
+              value: dsh-demo
+            - name: POOL
+              value: dsh-pool
+            - name: IDLE_TIMEOUT
+              value: "60"
+          resources:
+            requests: {cpu: 50m, memory: 128Mi}
+            limits: {cpu: 500m, memory: 256Mi}
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: dsh-gateway
+  namespace: dsh-demo
+spec:
+  selector:
+    app: dsh-gateway
+  ports:
+    - port: 8080
+      targetPort: 8080