docs(weather-agent): correct Step 3 to combined-sidecar (2/2) layout

Hai is right — on kagenti main, AuthBridge ships as a single combined
sidecar image (kagenti-extensions#411). The weather-service pod is 2/2
regardless of SPIRE: spiffe-helper is bundled inside the combined image
and activated per workload via SPIRE_ENABLED, not as a separate
container. The deployment guide explicitly lists "1 combined sidecar"
for both proxy-sidecar and envoy-sidecar modes
(docs/authbridge/deployment-guide.md and charts/kagenti/values.yaml).

The 3/3 separate-spiffe-helper layout I introduced in 8dacc17 described
the pre-#411 / v0.6 model — wrong for main.

Revert the container-count claim to 2/2 in both "Check pod status" and
"Verify injected containers" sections, and update the explanatory note
to match the combined-sidecar architecture. Container names returned by
kubectl ... containers[*].name are 'agent authbridge-proxy' (proxy mode)
or 'agent envoy-proxy' (envoy mode) regardless of SPIRE.

Addresses huang195's review on PR #439.

Assisted-By: Claude (Anthropic AI) <noreply@anthropic.com>
Signed-off-by: Mariusz Sabath <mrsabath@gmail.com>

Author: mrsabath

authbridge/demos/weather-agent/demo-ui.md

@@ -227,21 +227,22 @@ Wait for the Shipwright build to complete and the deployment to become ready.
 kubectl get pods -n team1
 ```
 
-Expected output (Step 2 defaults — `proxy-sidecar` mode with SPIRE identity enabled):
+Expected output (Step 2 defaults — `proxy-sidecar` mode):
 
 ```text
 NAME                               READY   STATUS    RESTARTS   AGE
-weather-service-58768bdb67-xxxxx   3/3     Running   0          2m
+weather-service-58768bdb67-xxxxx   2/2     Running   0          2m
 weather-tool-7f8c9d6b44-yyyyy     1/1     Running   0          5m
 ```
 
-> **Note:** The container count depends on the AuthBridge mode and whether
-> SPIRE identity is enabled. With Step 2's defaults — `proxy-sidecar` mode
-> plus SPIRE identity — `weather-service` runs `agent` + `authbridge-proxy`
-> + `spiffe-helper` (`3/3`). If you unchecked **Enable SPIRE identity**, the
-> `spiffe-helper` container is absent (`2/2`). With `envoy-sidecar` mode
-> you'll see `agent` + `envoy-proxy` (plus a `proxy-init` init container)
-> instead of `authbridge-proxy`. See the
+> **Note:** AuthBridge ships as a single combined sidecar image (since
+> kagenti-extensions#411). `weather-service` runs `agent` + the combined
+> AuthBridge sidecar — `2/2` — regardless of whether SPIRE identity is
+> enabled. The `spiffe-helper` is bundled inside the combined image and
+> activated per workload via `SPIRE_ENABLED` (driven by the
+> `kagenti.io/spire: enabled` label); it is not a separate container. In
+> `envoy-sidecar` mode the pod is still `2/2` (`agent` + the combined
+> sidecar) plus a `proxy-init` init container for iptables setup. See the
 > [AuthBridge deployment guide](https://github.com/kagenti/kagenti/blob/main/docs/authbridge/deployment-guide.md)
 > for the full mode/label reference.
 
@@ -251,24 +252,21 @@ weather-tool-7f8c9d6b44-yyyyy     1/1     Running   0          5m
 kubectl get pod -n team1 -l app.kubernetes.io/name=weather-service -o jsonpath='{.items[0].spec.containers[*].name}'
 ```
 
-Expected (Step 2 defaults — `proxy-sidecar` mode with SPIRE identity):
-
-```text
-agent authbridge-proxy spiffe-helper
-```
-
-Without SPIRE identity (Step 2 checkbox unchecked):
+Expected (Step 2 defaults — `proxy-sidecar` mode):
 
 ```text
 agent authbridge-proxy
 ```
 
-Or, in envoy-sidecar mode:
+Or, in `envoy-sidecar` mode:
 
 ```text
 agent envoy-proxy
 ```
 
+The container *names* don't change with SPIRE — `spiffe-helper` runs inside
+the combined sidecar, not as a separate container.
+
 ### Check operator-managed client registration
 
 After kagenti-extensions#411 / kagenti-operator#361, client registration runs