feat(gateway): verify an external gateway with a CA alone - #13909

…ms (#14413)

The release notes now list every user-visible change on `v1` since the
`v0.1.0-rc9` tag, including the breaking ones, and four example pages
drop claims that later changes made false.

## Problem

`docs/about/release-notes.md` listed three breaking changes and none of
the features, fixes, and onboarding changes that reached `v1` after
`v0.1.0-rc9`; it didn't name the configuration shapes the parser now
rejects or the intent record version `v0.1.0-rc9` writes.
Some example claims went stale:

- `examples/spark/README.md` said the pinned OpenShell has the Podman
TLS initialization blocker, NVIDIA/OpenShell#3427; its fix merged before
OpenShell 0.1.0, and `v1` pins 0.1.7.
- `examples/station/README.md` and `examples/gtc-dc/README.md` required
exactly one visible GPU on the host; since #13929,
`container.gpuDevices` lets a service on a host with more GPUs request
one.
- `examples/hcl/travel-team` said Fabric's Deep Agents adapter can't
turn reasoning off, NVIDIA/NeMo-Fabric#433; NVIDIA/NeMo-Fabric#439 fixed
that, and the pinned catalog's Deep Agents `reasoning_effort` accepts
`none`.
- The travel team cited #13313 for the booking key its service doesn't
receive, but #13313 closed when `openshell_api` landed.

## Change

- `docs/about/release-notes.md` gains "Changes Since v0.1.0-rc9",
grouped by area, from the commits in `v0.1.0-rc9..origin/v1`; where a
later commit changed an earlier one, the entry describes the current
code, and changes added and removed after the tag aren't listed:
- Agents and interfaces: #14037, #14038, #14269, #13981, #14024, #14186,
#14052, #14385, #13971, #13858, #13947, #14039, #14042, #14044, #14343.
- Inference: #13929, #14391, #14396, #14398, #14400, #13963, #13912,
#13964, #14388, #14390, #14397.
- Gateways and Kubernetes: #13909, #13970, #13922 (an existing
namespace, refused at plan by #13756, is now bound; cluster-wide reads
dropped), #14014, #14169, #13921.
- Plan, apply, and diagnostics: #14224, #13756, #14141, #14133, #14135,
#13775, #13744, #13701.
- Onboarding: #13693, #13695, #13741, #13757, #13851, #13978, #14228,
#14233, #14334, #14336.
- Examples and builds: #14166, #14184, #14188, #14191, #14192, #14200,
#13889, #14267, #14312, #14315, #14355, b30e9b4, #13781, #13813,
#14246, and the pins in `versions.json` and `image/fabric/Dockerfile`.
- Its breaking changes since the tag:
- the intent record moving from 15, which `v0.1.0-rc9` writes, through
16 (#14266), 17 (#14343), 18 (#13929), 19 (#14391) and 20 (#14394);
  - name-keyed `sandboxes` and `inferenceProviders` (#13703, #13705);
- a recipe `compatibility.gpu` outside every hardware profile (#13912);
- model tuning the adapter doesn't accept (#14111), and Hermes's
`max_tokens` losing its default (#14296);
  - `skills.paths` resolution (#14296);
  - endpoint and `networkCIDR` validation (#13847, #14081);
- the HCL `gateway_values` attribute (#14014), and Kubernetes ownership
receipts from before #13922 and #14014.
  The two earlier items stay, under their own heading.
- `examples/spark/README.md` replaces the closed OpenShell#3427 blocker
with the Podman and remote-model limits in `docs/resources/limits.md`.
- `examples/station/README.md` and `examples/gtc-dc/README.md` require
one GPU visible in the model container, and point to
`container.gpuDevices` for a host with more.
- `examples/hcl/travel-team/README.md` and `WALKTHROUGH.md` drop the
NeMo-Fabric#433 limitation, and the travel team's booking-key statements
link #14417 instead of #13313.

Not listed, because both changes landed after the tag: Deep Agents Code
(#14043, #14250), `compatibility.gpuCount` (#14391, #14394), and the
"Creating infrastructure state" progress step (#14169, #14248).

Checked and left unchanged: the root `README.md`,
`crates/nemoclaw-onboarding/README.md`,
`crates/nemoclaw-cli/assets/README.md`, `internal-docs/README.md`, the
other example READMEs, and every example YAML header comment. The GPU
autoscaling README and `load.sh` read the JSON fields `OperationResult`
serializes, and NVIDIA/OpenShell#4287 is fixed only after the pinned
0.1.7. The two pre-tag release-note items still match the schema and
SDK. `docs/README.md` is left to #14412, which retires the stale field
reference snapshot it describes.

Not verified: whether Hermes sends the booking key's placeholder to MCP
servers; #14417 tracks the live check.

## Beyond CI

Each relative link and anchor in the changed files resolves to an
existing file and heading.