Inherit nginx x509 header config, add operator runbook

- LookupConfig: ssl-client-cert / ssl-cert-chain-prefix /
  certificate-chain-length now fall back to the built-in nginx
  provider's settings (Config scope, then KC_SPI_X509CERT_LOOKUP_NGINX_*
  env vars), so switching the provider to "hybrid" needs no duplicated
  Helm values. Explicit hybrid-scope settings still override.
- Add LookupConfigTest covering inheritance, override, and defaults
  (14 tests total, all passing).
- Add RUNBOOK.md: phase-by-phase deployment procedure sized to 30-min
  test windows, with verification checklists, forged-header negative
  test, rollback per phase, and failure triage table.
- README/Dockerfile.example updated to match; stop tracking target/
  build output (.gitignore added).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

keycloak-hybrid-x509-spi/Dockerfile.example

@@ -17,7 +17,8 @@ COPY --from=builder /opt/keycloak/ /opt/keycloak/
 
 # Runtime config (usually set via Helm/manifest env instead of baked in):
 #   KC_SPI_X509CERT_LOOKUP_PROVIDER=hybrid
-#   KC_SPI_X509CERT_LOOKUP_HYBRID_SSL_CLIENT_CERT=<your existing header name>
+#   (header name is inherited from your existing KC_SPI_X509CERT_LOOKUP_NGINX_* env
+#    vars — leave those in the Helm values as-is)
 #   KC_SPI_X509CERT_LOOKUP_HYBRID_TRUST_MODE=log        # then 'enforce' after cycle 3
 #   KC_TRUSTSTORE_PATHS=/opt/keycloak/conf/truststores  # CA bundle (KC 25+)
 #   KC_LOG_LEVEL=INFO,com.example.keycloak.x509:debug   # during rollout