Document K8s public examples in model card

README.md

@@ -40,9 +40,11 @@ Project repository: [github.com/EBWi11/SecEBL](https://github.com/EBWi11/SecEBL)
 | Inference performance | RTX 5090 spot-check: mean 5,308.72 unique cmdlines/s with FP16 + SDPA; exact raw-event cache lookup measured separately at about 1.8M rows/s. |
 | Training setup | `Alibaba-NLP/gte-modernbert-base`, MNRL with hard-negative-aware batches, RTX 5090 32GB, 128 full-pass epochs, batch size 112, about 16.2 hours. |
 
-The public examples are a reviewed, publicly releasable subset of the internal
-Linux final benchmark: 10,520 rows across 531 sessions. They exist so users can
-run the model locally and inspect outputs without access to private telemetry.
+The public examples include a reviewed, publicly releasable subset of the
+internal Linux final benchmark plus normalized Kubernetes AuditLog examples:
+10,520 Linux rows across 531 sessions and 144 K8s rows across 46 sessions. They
+exist so users can run the model locally and inspect outputs without access to
+private telemetry.
 The full training corpora, full internal benchmarks, private pressure-stream
 rows, and private run logs are not redistributed because parts of them contain
 real telemetry or real operational context.
@@ -371,8 +373,9 @@ rows/s. Cache hits reuse saved L1 top-k results and do not run model inference.
 ## L2 Artifact
 
 This repository includes an experimental fitted L2 session scorer so the
-companion GitHub `scripts/run_examples.sh` can run the public Linux example
-sessions end to end when this model directory is used as `MODEL_DIR`.
+companion GitHub `scripts/run_examples.sh` can run the public Linux and K8s L1
+examples, plus Linux example-session scoring, when this model directory is used
+as `MODEL_DIR`.
 
 In this release, a **session** is a sequence of events grouped by `session_id`.
 L1 labels each event independently. L2 scores the whole session by aggregating