[SIMPL-30451] Add sandbox deployment values and the pull-secret caveat

yaml/sandbox/values-sandbox-gitea.yaml carries the registry coordinates, the pull secret both namespaces need, and the commit SHA the two images share. The sandbox registry rejects anonymous pulls, so a payload namespace without its own pull secret leaves the dispatching op waiting on a pod that never starts - readiness check L4 now says so.

Changelog: added

yaml/sandbox/values-sandbox-gitea.yaml

@@ -0,0 +1,57 @@
+# Sandbox deployment values - Gitea registry.
+#
+# NOT CLUSTER-VERIFIED. These values are written against images that exist and a
+# registry whose auth behaviour was checked, but they have not been applied to a
+# Simpl cluster. Confirm and amend after the first deployment.
+#
+# Use these instead of the code.europa.eu references in
+# yaml/values-dagster-distributed-execution.yaml and
+# yaml/loosely-coupled/values-pipes-payload.yaml when deploying to the
+# dataprovider01 sandbox. Both images are published by
+# .gitea/workflows/docker-publish.yml.
+#
+# The tag below is a short commit SHA and is the same for both images. That is
+# the version lock: the code location and the payload it dispatches must come
+# from one commit. Bump both together or not at all.
+#
+# The sandbox Gitea registry requires authentication - an anonymous manifest GET
+# returns 401 - so a pull secret is required in every namespace that pulls either
+# image. Create it with a Gitea access token that has read:package scope:
+#
+#   kubectl -n <namespace> create secret docker-registry gitea-registry \
+#     --docker-server=gitea.dataprovider01.sandbox-cat-dat.simpl-europe.eu \
+#     --docker-username=<gitea-user> \
+#     --docker-password=<gitea-token>
+#
+# The payload namespace needs it too: PipesK8sClient creates that Job, and a
+# missing pull secret there leaves the op waiting on a pod that never starts,
+# which surfaces as pod_wait_timeout rather than as an image error.
+
+dagster:
+  dagster-user-deployments:
+    deployments:
+      - name: distributed-execution
+        image:
+          repository: gitea.dataprovider01.sandbox-cat-dat.simpl-europe.eu/j.r/distributed-execution
+          tag: 5122da4691f9
+          pullPolicy: IfNotPresent
+        imagePullSecrets:
+          - name: gitea-registry
+        env:
+          - name: PIPES_PAYLOAD_IMAGE
+            value: gitea.dataprovider01.sandbox-cat-dat.simpl-europe.eu/j.r/distributed-execution-payload:5122da4691f9
+          - name: PIPES_PAYLOAD_NAMESPACE
+            value: dagster
+
+  runLauncher:
+    config:
+      k8sRunLauncher:
+        imagePullSecrets:
+          - name: gitea-registry
+        runK8sConfig:
+          containerConfig:
+            env:
+              - name: PIPES_PAYLOAD_IMAGE
+                value: gitea.dataprovider01.sandbox-cat-dat.simpl-europe.eu/j.r/distributed-execution-payload:5122da4691f9
+              - name: PIPES_PAYLOAD_NAMESPACE
+                value: dagster