Normalise the pod model returned by CoreV1Api (#7)

get_pod() returned kubernetes' V1Pod model, but dsh_cookie() indexes it as a
dict (pod.get("metadata")), so every gateway handshake crashed with:

  AttributeError: 'V1Pod' object has no attribute 'get'

and every proxied request answered 500. The unit tests inject a fake that
returns dicts, so the mismatch only appeared against a real API server.

Normalise at the adapter boundary with ApiClient().sanitize_for_serialization
and cover it with a test that returns a real V1Pod.

Also document digest-pinned gateway rollouts: the workflow publishes the
mutable :gateway tag, and imagePullPolicy: IfNotPresent keeps the cached old
image across kubectl apply / rollout restart.

Co-authored-by: SREDevOpsAgents <agents@sredevops.org>

examples/dsh-agents-as-a-service/gateway/test_gateway.py

@@ -497,6 +497,25 @@ async def test_kubernetes_read_pod_logs_forwards_container_and_tail(monkeypatch)
     assert calls == [(("pod-1", "test-ns"), {"container": "dsh-web", "tail_lines": 200})]
 
 
+@pytest.mark.asyncio
+async def test_kubernetes_get_pod_normalises_the_v1pod_model(monkeypatch):
+    """CoreV1Api returns a V1Pod model; callers index it like a dict."""
+    from kubernetes.client import V1ObjectMeta, V1Pod
+
+    from gateway import Kubernetes
+
+    async def fake_call(which, method, *args):
+        return V1Pod(metadata=V1ObjectMeta(name="dsh-alice", uid="pod-uid-9"))
+
+    k8s = Kubernetes("test-ns")
+    monkeypatch.setattr(k8s, "_call", fake_call)
+
+    pod = await k8s.get_pod("dsh-alice")
+
+    assert isinstance(pod, dict)
+    assert pod["metadata"]["uid"] == "pod-uid-9"
+
+
 # --- health / landing / redirect ------------------------------------------