chore(examples): migrate mutual-tls and fix stale Core links

content/docs/capabilities/non-http/examples/rdp.mdx

@@ -64,12 +64,10 @@ Some clients, like Remmina, support running commands before and after connection
 
 <TunnelExample/>
 
-1. Save the script above to your home folder (`~/`), and make it executable:
+1. Save the script above to your home folder as `~/pomerium-tunnel.sh`, then make it executable:
 
     ```bash
-    cd ~/
-    wget https://github.com/pomerium/pomerium/blob/main/examples/tcp/pomerium-tunnel.sh
-    chmod +x pomerium-tunnel.sh
+    chmod +x ~/pomerium-tunnel.sh
     ```
 
 1. Update your client profile to execute the script before and after the connection:

content/docs/guides/cloud-run.mdx

@@ -22,8 +22,6 @@ See [this GitHub issue](https://github.com/pomerium/pomerium/issues/4091) for mo
 
 :::
 
-This recipe's sources can be found [on github](https://github.com/pomerium/pomerium/tree/main/examples/cloudrun)
-
 ## Background
 
 Services on [Cloud Run](https://cloud.google.com/run) and other Google Cloud serverless products can be restricted to only permit access with a properly signed [bearer token](https://cloud.google.com/run/docs/authenticating/service-to-service). This allows requests from other services running in GCP or elsewhere to be securely authorized despite the endpoints being public.

content/docs/reference/routes/tls.mdx

@@ -30,7 +30,7 @@ This reference covers all of Pomerium's TLS route settings:
 
 If specified, Pomerium will present this client certificate to upstream services when requested to enforce [mutual authentication](https://en.wikipedia.org/wiki/Mutual_authentication) (mTLS).
 
-For more details, see our [mTLS example repository](https://github.com/pomerium/pomerium/tree/main/examples/mutual-tls) and the [Upstream mTLS With Pomerium](/docs/internals/certificates-and-tls) guide.
+For more details, see our [mTLS example](https://github.com/pomerium/documentation/tree/main/content/examples/mutual-tls) and the [Upstream mTLS With Pomerium](/docs/internals/certificates-and-tls) guide.
 
 ### How to configure \{#how-to-configure-tls-client-certificate}
 

content/examples/cloudrun/deploy.sh.md

@@ -4,7 +4,9 @@
 ```bash title="deploy.sh"
 #!/bin/bash
 
-# Install gcloud beta
+# domain-mappings on fully-managed Cloud Run is still under `gcloud beta`
+# (the GA `gcloud run domain-mappings` is Cloud Run for Anthos only and
+# rejects --region as of gcloud SDK 555+).
 gcloud components install beta
 
 # Capture current project number

content/examples/cloudrun/policy.template.yaml.md

@@ -1,12 +1,18 @@
 ```yaml title="policy.template.yaml"
 - from: https://hello.cloudrun.pomerium.io
   to: ${HELLO_URL}
-  allowed_domains:
-    - gmail.com
   enable_google_cloud_serverless_authentication: true
+  policy:
+    - allow:
+        or:
+          - domain:
+              is: gmail.com
 - from: https://verify.cloudrun.pomerium.io
   to: https://verify.pomerium.com
   pass_identity_headers: true
-  allowed_domains:
-    - gmail.com
+  policy:
+    - allow:
+        or:
+          - domain:
+              is: gmail.com
 ```

content/examples/config/route.example.yaml.md

@@ -1,11 +1,8 @@
 ```yaml
 # This file contains only route and policy configuration details. Other
-# configuration settings required by pomerium are excluded for clarity.
-# See: https://www.pomerium.io/docs/reference/
-
-#
-# For a complete self contained configuration see : config.example.yaml.
-# Or, mix and match a policy file (this) with env vars : config.example.env
+# configuration settings required by Pomerium are excluded for clarity.
+# See https://www.pomerium.com/docs/reference for the full configuration
+# reference.
 
 routes:
   - from: https://verify.localhost.pomerium.io