Normalise the pod model returned by CoreV1Api (#7)

get_pod() returned kubernetes' V1Pod model, but dsh_cookie() indexes it as a
dict (pod.get("metadata")), so every gateway handshake crashed with:

  AttributeError: 'V1Pod' object has no attribute 'get'

and every proxied request answered 500. The unit tests inject a fake that
returns dicts, so the mismatch only appeared against a real API server.

Normalise at the adapter boundary with ApiClient().sanitize_for_serialization
and cover it with a test that returns a real V1Pod.

Also document digest-pinned gateway rollouts: the workflow publishes the
mutable :gateway tag, and imagePullPolicy: IfNotPresent keeps the cached old
image across kubectl apply / rollout restart.

Co-authored-by: SREDevOpsAgents <agents@sredevops.org>

examples/dsh-agents-as-a-service/README.md

@@ -198,6 +198,18 @@ kubectl -n dsh-demo port-forward svc/dsh-gateway 18080:8080
 
 > The gateway binds `8080`; the local port-forward uses `18080` and never `3080`.
 >
+> **Re-deploying after a new image?** The workflow publishes the mutable `:gateway` tag and the
+> Deployment uses `imagePullPolicy: IfNotPresent`, so a node that already cached the tag keeps
+> the old image across `kubectl apply`/`rollout restart`. Pin the digest for a reproducible
+> rollout (the workflow's `Inspect image` step and `docker buildx imagetools inspect` both show
+> it):
+>
+> ```bash
+> kubectl -n dsh-demo set image deploy/dsh-gateway \
+>   gateway=ghcr.io/sredevopsorg/deepseek-kubernetes-sandbox@sha256:<digest>
+> kubectl -n dsh-demo rollout status deploy/dsh-gateway --timeout=120s
+> ```
+>
 > **Applying over an existing install?** Run `kubectl diff -f 10-sandboxtemplate.yaml`
 > first. Cluster-specific fields such as `nodeAffinity` and the warm-pool replica count are
 > intentionally not in the repo manifests; preserve them with a targeted patch instead of a