feat: Add CI/CD and documentation polish (Phase 4)

[Alan-Cha]

Summary

Phase 4 (FINAL) of the Vault pattern: CI/CD integration and documentation polish.

Stacked on: #381 (Phase 3 - Webhook integration)

This PR completes the Vault pattern implementation by adding CI/CD automation and comprehensive workflow documentation.

What This Adds

CI/CD Integration

• Added vault-fetcher to build matrix in .github/workflows/build.yaml
• Will automatically build and push ghcr.io/kagenti/kagenti-extensions/vault-fetcher on releases

Documentation Updates

• Updated CLAUDE.md — Added vault-fetcher to container images table
• Created STACKED_PR_WORKFLOW.md (300+ lines) — Comprehensive stacked PR guide

STACKED_PR_WORKFLOW.md — Critical Documentation

This new document is essential for maintaining the stacked PR workflow, especially when earlier PRs receive review feedback.

Key sections:

1. Understanding stacked PRs — What they are, benefits
2. Creating stacked PRs — Manual and gh-stack methods
3. ⚠️ THE CRITICAL REBASE PROCESS — How to cascade rebase when earlier branches change
4. Handling conflicts — Step-by-step conflict resolution
5. Merging strategy — Order and base branch updates
6. Common scenarios — Adding/removing branches, cherry-picking fixes
7. Best practices — Force-with-lease, testing, communication

Why This Matters

Example scenario covered:

• Reviewer requests changes to Phase 1 (authlib/vault)
• You update feat/vault-integration branch
• ALL SUBSEQUENT BRANCHES MUST BE REBASED (Phase 2, 3, 4)
• Document shows exact commands and process

Rebase cascade commands:
```bash
git checkout feat/vault-fetcher-cli && git rebase feat/vault-integration && git push --force-with-lease
git checkout feat/vault-webhook && git rebase feat/vault-fetcher-cli && git push --force-with-lease
git checkout feat/vault-docs-polish && git rebase feat/vault-webhook && git push --force-with-lease
```

Files Modified

• .github/workflows/build.yaml — Add vault-fetcher to matrix
• CLAUDE.md — Document vault-fetcher image

Files Added

• STACKED_PR_WORKFLOW.md (300+ lines) — Complete stacked PR guide

Total: ~454 lines added

Stacked PR Structure (FINAL)

```
main
└─> #379 (Phase 1: authlib/vault library)
└─> #380 (Phase 2: vault-fetcher CLI)
└─> #381 (Phase 3: Webhook integration)
└─> THIS PR (Phase 4: CI/CD & docs) ← FINAL
```

Completion Status

✅ Phase 1: authlib/vault library
✅ Phase 2: vault-fetcher CLI tool
✅ Phase 3: Webhook integration docs
✅ Phase 4: CI/CD + workflow docs

🎉 Vault pattern implementation is COMPLETE with this PR!

Merge Strategy

After all reviews are complete:

1. Merge feat: Add Vault integration library to authlib #379 (Phase 1) into main
2. GitHub will offer to update feat: Add vault-fetcher CLI tool (Phase 2) #380's base to main (or use gh pr edit 380 --base main)
3. Merge feat: Add vault-fetcher CLI tool (Phase 2) #380 (Phase 2) into main
4. Update feat: Add webhook integration guide (Phase 3) #381's base to main
5. Merge feat: Add webhook integration guide (Phase 3) #381 (Phase 3) into main
6. Update feat: Add CI/CD and documentation polish (Phase 4) #382's (this PR) base to main
7. Merge feat: Add CI/CD and documentation polish (Phase 4) #382 (Phase 4) into main

Or: Squash Phases 2-4 together and merge as one final PR after Phase 1 merges.

Review Notes

Focus review on:

1. CI/CD config: Is the build matrix entry correct?
2. Documentation accuracy: Does STACKED_PR_WORKFLOW.md cover all scenarios?
3. Completeness: Any missing documentation?

Testing

After merge, vault-fetcher will build on next tag push:
```bash
git tag v0.2.0
git push origin v0.2.0

Triggers build.yaml workflow

Pushes ghcr.io/kagenti/kagenti-extensions/vault-fetcher:v0.2.0

```

Assisted-By: Claude (Anthropic AI) noreply@anthropic.com