feat(repo)!: restructure around the dsh-harness image and one example per implementation

- the root Dockerfile is the primary artifact; versions.env is the single source of truth
- merge gateway-api/dsh-demo into examples/dsh-agents-as-a-service (manifests/, exposure variants)
- move the single-tenant template into examples/minimal-single-tenant
- publish the gateway as a nested package under the repository image
- mirror the DSH ref for release identities (first release dsh-v0.2.1-rc.2-r2)
- CI: lint/python/manifests/gateway-image, reusable multi-arch build, tag-driven release, weekly e2e
- docs: README, docs/{main-image,examples,gitflow,versioning}, example READMEs, AGENTS.md, governance
- SSO is opt-in again; gateway pull policy and cookie defaults match the documented demo

BREAKING CHANGE: example manifest paths, the gateway image name, and the removal
of deploy/ and gateway-api/ affect existing deployments; see the migration table
in README.md.

.github/pull_request_template.md

@@ -0,0 +1,31 @@
+## Summary
+
+<!-- What changes, and why? Link the issue: Closes #123 -->
+
+## Type of change
+
+- [ ] feat: new capability or example
+- [ ] fix: bug fix
+- [ ] docs: documentation only
+- [ ] refactor: no behavior change
+- [ ] build / ci: tooling, images, workflows
+- [ ] chore: maintenance
+
+## Breaking change
+
+- [ ] Yes, and the migration is documented in the description
+- [ ] No
+
+## Checklist
+
+- [ ] make check passes (versions, example layout, manifest YAML)
+- [ ] make test passes (gateway unit tests)
+- [ ] make lint passes (ruff, shellcheck; yamllint/actionlint where installed)
+- [ ] Docs updated for the change (root README, docs/, example README)
+- [ ] No secrets or usable credentials committed
+- [ ] CHANGELOG.md was not edited by hand (generated by git-cliff)
+- [ ] Version pins changed only through versions.env / make set-version
+
+## Testing
+
+<!-- Commands run, clusters used, results. Mention if kind e2e was skipped. -->