feat(repo)!: restructure around the dsh-harness image and one example per implementation

- the root Dockerfile is the primary artifact; versions.env is the single source of truth
- merge gateway-api/dsh-demo into examples/dsh-agents-as-a-service (manifests/, exposure variants)
- move the single-tenant template into examples/minimal-single-tenant
- publish the gateway as a nested package under the repository image
- mirror the DSH ref for release identities (first release dsh-v0.2.1-rc.2-r2)
- CI: lint/python/manifests/gateway-image, reusable multi-arch build, tag-driven release, weekly e2e
- docs: README, docs/{main-image,examples,gitflow,versioning}, example READMEs, AGENTS.md, governance
- SSO is opt-in again; gateway pull policy and cookie defaults match the documented demo

BREAKING CHANGE: example manifest paths, the gateway image name, and the removal
of deploy/ and gateway-api/ affect existing deployments; see the migration table
in README.md.

versions.env

@@ -0,0 +1,26 @@
+# Single source of truth for every pinned version and image name in this
+# repository. Consumed by the Makefile, build.sh, scripts/*.sh and the GitHub
+# Actions workflows. Never hard-code these values elsewhere: run "make check"
+# (scripts/check-versions.sh) to verify every pin.
+
+# Upstream DeepSeek Harness source, and the ref this repository packages.
+DSH_REPO=https://github.com/deepseek-ai/deepseek-harness.git
+DSH_VERSION=dsh-v0.2.1-rc.2
+PNPM_VERSION=11.28.5
+
+# Release identity = DSH_VERSION plus an optional repository revision.
+# An empty RELEASE_REVISION is the first release at this DSH ref; rN (N >= 2)
+# marks a repository-only re-release at the same DSH ref. The dsh-v0.2.1-rc.2
+# image tag is already published on GHCR and tags are immutable, so the first
+# release under the current scheme is dsh-v0.2.1-rc.2-r2.
+RELEASE_REVISION=r2
+
+# Control-plane versions used by the examples and their manifests.
+AGENT_SANDBOX_VERSION=v1.0.7
+GATEWAY_API_VERSION=v1.2.1
+OAUTH2_PROXY_IMAGE=quay.io/oauth2-proxy/oauth2-proxy:v7.15.5
+
+# Registry layout: the main image is the repository itself, and every example
+# component is a nested package below it (<registry>/<owner>/<repo>/<example>/<component>).
+GHCR_IMAGE=ghcr.io/sredevopsorg/deepseek-kubernetes-sandbox
+GATEWAY_IMAGE=ghcr.io/sredevopsorg/deepseek-kubernetes-sandbox/dsh-agents-as-a-service/gateway