docs: simplify public documentation for scanning (#2139)

docs/public/k8s.md

@@ -8,6 +8,13 @@ status: experimental
 
 Kandev ships example Kubernetes YAML in `k8s/`. It is a single-replica, persistent deployment example—not a Helm chart, operator, or supported high-availability topology. The release workflow publishes container images but does not apply these manifests to a cluster. Review and adapt every manifest before production use.
 
+## Quick path
+
+1. Pin a published image and keep one replica.
+2. Apply the ConfigMap, PVC, Service, and transformed Deployment.
+3. Port-forward first; add TLS and authentication before exposing an Ingress.
+4. Back up the database and PVC before upgrades or deletion.
+
 ## Architecture and limitations
 
 The example creates:
@@ -164,6 +171,11 @@ Use the SSL mode and trust material required by your database. PostgreSQL moves
 
 ## Agent execution in a pod
 
+> **Docker boundary:** Do not add only a Docker socket mount. The runtime also needs helper, credential-session, and local-clone bind sources at matching daemon-host paths. Privileged Docker-in-Docker has a separate security and persistence model and no supplied manifest.
+
+<details>
+<summary>Agent execution, resources, and probes</summary>
+
 Local and Worktree profiles run agents inside the Kandev pod. Install agent CLIs from **Settings > Agents**, or derive an image that contains them. Runtime npm installs persist under `/data/.npm-global`. Choose the universal image when tasks need its additional build toolchains, but account for the larger image and non-root volume requirement.
 
 The checked-in ConfigMap disables Local Docker. Do not add only a Docker socket mount: the current runtime also needs helper, credential-session, and local-clone bind sources to exist at identical paths on the Docker daemon host, and it currently selects a Linux/amd64 helper. See [containerized control plane limitation](docker.md#containerized-control-plane-limitation). A privileged Docker-in-Docker sidecar has a separate security and persistence model and no supplied Kandev manifest.
@@ -197,6 +209,8 @@ startupProbe:
 
 Tune from observed startup time. Keep readiness on `/health`; use separate external monitoring for dependencies and real workflows.
 
+</details>
+
 ## Ingress and exposure
 
 Kandev has no built-in user-auth boundary. Do not expose the example Ingress publicly until an authenticated gateway and TLS are in place.