docs: differentiator demo walkthrough + Act 2 robustness

[pdettori]

What

Adds serverless-harness-demo.md — a ~10-minute, differentiator-focused kind walkthrough with two acts — and wires it into the README so a new user can try the harness in minutes:

• Act 1 — Durable resume across a true zero: cold-start a pod, scale to zero, resume the same session from a fresh pod that still remembers the policy (state lives in Redis, not the process).
• Act 2 — A fleet from zero: fan five async leaves onto a Redis stream, watch KEDA materialize leaf-worker pods 0→N to drain them, collect verdicts, then collapse back to zero.

README Quick Start

Fleshes out the existing Quick Start with the three copy-paste bootstrap steps (clone --recurse-submodules, export credential, setup-kind.sh) matching the demo's Act 0, notes the default published-image pull (no local build) and default model, and points prominently at the two-act walkthrough as the guided tour.

Act 2 robustness

While running the walkthrough live, Act 2 produced no worker pods and 2e hung. Root cause: the leaf-worker ScaledJob wasn't applied (2a). The batch is still accepted onto the Redis stream, but with no ScaledJob, KEDA has nothing to scale — so no workers start in 2d and 2e polls forever. Everything else (KEDA, image, CRD, dispatch → lag=5 on the stream) was healthy. Applying the ScaledJob immediately spawned 5 workers, drained the queue, and returned the expected verdicts (auth/payments FLAGGED, rest CLEAR).

Two changes come out of that:

1. Guard 2a — add kubectl get scaledjob leaf-worker right after the apply, plus a note that the check must pass before 2d and that a ScaledJob does not survive a kind delete/recreate. A skipped/failed 2a now fails loudly instead of silently no-op'ing.
2. ttlSecondsAfterFinished: 60 on the leaf Job template — finished worker Jobs and their pods now GC themselves ~60s after completion: long enough to kubectl logs a worker for the 2e reveal, short enough that the fleet clears on its own after 2f instead of leaving Completed pods behind.

Verification

Ran the full walkthrough on a live kind-sh-knative cluster: Act 1 resume works across scale-to-zero; Act 2 spawns 5 leaf-workers, drains the stream (lag 5→0), returns correct verdicts, and collapses back to zero. ttlSecondsAfterFinished: 60 confirmed applied and reading back on the live ScaledJob.

🤖 Generated with Claude Code

[pdettori]

Docs PR review — two non-blocking notes below; no must-fix issues.

Summary. Clean rewrite into a focused two-act walkthrough plus a runnable README Quick Start. The one functional change (ttlSecondsAfterFinished: 60) is correctly placed under jobTargetRef as a valid JobSpec field with a clear rationale comment. Nice bonus: the diff removes a leaked internal gateway URL (ete-litellm.bx.cloud9.ibm.com) and token placeholder in favor of generic ones. Verified against the repo: SH_IMAGE default, the claude-haiku-4-5 model, and the "KEDA installed but ScaledJob not" narrative in setup-kind.sh all check out.

Areas reviewed: Docs (README + demo), YAML (KEDA ScaledJob) · Agent/IDE config (.claude/.vscode): none · Commits: 3, all DCO-signed · CI: all green.

(Posted as a COMMENT review since GitHub doesn't allow self-approval — treat as an APPROVE-equivalent; both notes are optional.)