docs: Add kubectl deployment guide for manual agent deployment

[pdettori]

Summary

There is no single reference guide for deploying an agent via kubectl (without the Kagenti UI/backend). The pieces exist across multiple docs and demos, but a developer deploying manually has to discover the conventions and required resources by reading operator source code.

Problem

The controller assumes the Service name matches the workload name (ServiceName: targetRef.Name in internal/controller/agentcard_controller.go:374). This convention is not documented as a requirement. A developer deploying via kubectl who names their Service differently will get ServiceNotFound errors with no clear guidance.

The required resources and conventions are spread across:

• docs/dynamic-agent-discovery.md — covers Deployment+Service example and AgentCard auto-creation, but not the full checklist
• demos/agentcard-spire-signing/k8s/ — complete manifests but specific to SPIRE signing flow
• docs/agentcard-signature-verification.md — covers the signing init container setup

Proposed Content

A single kubectl deployment guide covering the full resource checklist:

1. Namespace — with appropriate labels
2. ServiceAccount — for SPIRE registration if using signing
3. Deployment — required labels:
   • kagenti.io/type: agent
   • protocol.kagenti.io/a2a: ""
   • app.kubernetes.io/name: <name>
4. Service — must match the Deployment name (controller convention)
5. ConfigMap (<name>-card-unsigned) — if using SPIRE signing; should contain real capabilities (see Signed AgentCard always has empty skills/capabilities in automated deploy path #292)
6. AgentCard CR — optional (sync controller auto-creates one), but needed to configure identityBinding

The guide should include a ready-to-use template covering all six resources, with annotations explaining which parts are required vs optional and which conventions must be followed.

Related

• Signed AgentCard always has empty skills/capabilities in automated deploy path #292 — Signed AgentCard empty skills/capabilities gap
• docs/dynamic-agent-discovery.md — existing partial coverage
• demos/agentcard-spire-signing/k8s/ — existing demo manifests