docs(networking): add K3s and Mainland China deployment guidance

## Summary

Add deployment guidance for K3s-based NemoClaw environments and Mainland China network conditions.

Parent: #2218

## Problem

K3s-based deployments and China network conditions are not documented clearly enough for reliable setup. Operators may encounter blocked domains, proxy/TLS issues, image-pull failures, DNS differences, CA certificate requirements, and K3s-specific runtime behavior without clear guidance.

This is especially important for customers deploying in Mainland China or in restricted enterprise networks where default public registries, package sources, and provider endpoints may be unavailable or unreliable.

## Related Issues

- #1836 Customize K3s
- #2423 NemoClaw doc related to K8s not present
- #306 Rancher Desktop with corporate proxy
- #2481 K3s startup overlayfs nested mount error
- #3136 host.docker.internal does not resolve inside K3s pods

## Proposed Scope

- Document supported and unsupported K3s deployment shapes.
- List required external domains, registries, package sources, provider endpoints, and model/artifact sources.
- Provide China-network guidance for mirrors, internal registries, proxy, DNS, CA certificates, and blocked domains.
- Clarify where K3s differs from the default Docker-driver path.
- Add troubleshooting for common K3s/network failures, including image pulls, DNS, TLS/CA, proxy, and nested container/storage issues.

## Non-goals

- Do not make every K3s distribution or Kubernetes environment officially supported.
- Do not promise that all cloud provider/model endpoints are reachable from China.
- Do not replace the air-gapped/offline install-bundle work tracked separately.

## Acceptance Criteria

- [ ] Docs include a K3s deployment section with supported topology and caveats.
- [ ] Docs include a Mainland China/restricted-network checklist.
- [ ] Required domains, ports, registries, package sources, and provider endpoints are listed.
- [ ] Proxy, DNS, TLS/CA, and mirror/internal-registry setup is documented.
- [ ] Common K3s/runtime failure modes are documented with remediation guidance.
- [ ] Existing K3s-related issues are referenced where relevant.