Normalise the pod model returned by CoreV1Api (#7)

get_pod() returned kubernetes' V1Pod model, but dsh_cookie() indexes it as a
dict (pod.get("metadata")), so every gateway handshake crashed with:

  AttributeError: 'V1Pod' object has no attribute 'get'

and every proxied request answered 500. The unit tests inject a fake that
returns dicts, so the mismatch only appeared against a real API server.

Normalise at the adapter boundary with ApiClient().sanitize_for_serialization
and cover it with a test that returns a real V1Pod.

Also document digest-pinned gateway rollouts: the workflow publishes the
mutable :gateway tag, and imagePullPolicy: IfNotPresent keeps the cached old
image across kubectl apply / rollout restart.

Co-authored-by: SREDevOpsAgents <agents@sredevops.org>

examples/dsh-agents-as-a-service/gateway/gateway.py

@@ -475,13 +475,17 @@ class Kubernetes:
 
     async def get_pod(self, name: str) -> dict | None:
         try:
-            return await self._call(
+            pod = await self._call(
                 "core", "read_namespaced_pod", name, self.namespace
             )
         except ApiException as exc:
             if exc.status == 404:
                 return None
             raise
+        # CoreV1Api returns a V1Pod model while every other call in this module
+        # (CRD calls, fakes in tests) yields a dict. Normalise at the boundary
+        # so callers can keep using ``pod.get(...)``.
+        return k8s_client.ApiClient().sanitize_for_serialization(pod)
 
     async def read_pod_logs(
         self, name: str, container: str, tail_lines: int